LOT 001 ONIONSKIN
ONIONSKIN
Manual · Version 1.1
ODDLOTS01/17
ONIONSKINWhat it is
One uniquely marked script per recipient, and a way to find out whose copy leaked.
Drop a script in. Paste the list of names. Press the button. Onionskin never connects to anything: no account, no network, no telemetry, no cloud.
LOT 00102/17
ONIONSKINContents

Contents

  1. 02What it is
  2. 04Before you start
  3. 05The window
  4. 06Making copies
  5. 07The mark
  6. 08Copy ID
  7. 09Protection
  8. 10File size
  9. 11Naming
  10. 12Tracing
  11. 13The record
  12. 14Keyboard
  13. 15Limits
  14. 16Where things live
LOT 00103/17
ONIONSKINBefore you start

What it needs

Your key
In your download email. Asked for once, at first launch, and checked on your Mac. Keep it: a new Mac asks again. One Film & Video key opens four apps. Lost keys: software@filmflamingo.com.
Requires
macOS 12 Monterey or later, on Apple Silicon or Intel.
Takes in
Screenplay PDFs. Also PNG, JPEG, HEIC and TIFF images, one page each.
Gives back
One marked PDF per recipient, named and ready to attach, plus a record of the run.
Two tabs
Watermark makes the copies. Trace a copy answers who had one.
Note

Several scripts at once is fine. You can also drop PDFs on the Dock icon, or use Open With in the Finder.

LOT 00104/17
ONIONSKINThe window

Where things are

1234567
1
Make copies, and Trace a copy. The two halves of the app.
2
SCRIPTS. Drop the PDF here, or click to browse.
3
SEND TO. One name a line.
4
SAVE TO. Beside the script, or a folder you pick.
5
The button. It names the number of copies.
6
The preview. Page one, as it will go out.
7
Look, Protection and Naming.
LOT 00105/17
ONIONSKINMaking copies
The main job

Making the copies

  1. Add the scriptDrop PDFs on the well, or click it to browse.
  2. Paste the namesOne per line. It copes with what you would paste out of an email: bullets, numbering, Jane Doe <jane@agency.com>, bare addresses. Duplicates come out, case ignored.
  3. Choose where to saveBeside the script in a Watermarked folder, or anywhere you pick.
  4. Press WatermarkCopies render across all cores. Progress is per copy, and you can stop mid run.
If the list is empty

You get a single unnamed copy. That is the intended way to make a house copy.

LOT 00106/17
ONIONSKINThe mark

Four styles

DIAGONAL+ FOOTERDIAGONALFOOTERTILED
The diagonal
The recipient's name across each page.
The footer
Your notice, the name, the date and the copy ID.
Adjustable
Strength, size, colour, typeface and caps, with a live preview.
LOT 00107/17
ONIONSKINCopy ID

Six characters

Written XXXX-XX, in Crockford base32.

That alphabet has no I, L, O or U in it, so nothing in a code can be misread as something else on a photographed page. The 0/O and 1/I confusions cannot arise.

The code is derived from the script, the recipient and the date, so the same person gets the same code for a given script on a given day. A page stays traceable even when the name has been cropped off it.

On collisions

Six characters is 1,073,741,824 codes. At 300 recipients the chance of a repeat is about 4 in 100,000. Small is not zero, so every run checks and re-seeds rather than trusting the arithmetic.

LOT 00108/17
ONIONSKINProtection

Three settings

Flatten pages to images
On by default. Each page is rendered to a picture. No text object is left, so the mark cannot be selected and deleted and the script cannot be copied out.
Ask readers not to print or copy
On by default. Sets the PDF permission flags. Preview honours them. Many tools ignore them and stripping them takes seconds. It raises the effort. It does not prevent anything.
Require a password to open
Encrypts each copy with AES-128. Unlike the flags, this one is real: without the password the file will not open.
The password is never stored

Not in the manifest, not in settings, not in the record. Set it each time you make copies.

LOT 00109/17
ONIONSKINFile size

What flattening costs

150 dpi, colour
About 24 MB per copy. The default.
150 dpi, greyscale
About 13 MB. Usually the right call when emailing a feature.
110 dpi, colour
About 16 MB.
Flattening off
Well under 1 MB, and the mark is removable by anyone who opens the PDF in an editor.
Figures are for a 110 page script

The app shows a live estimate per copy before you commit, and warns past roughly 20 MB, because most mail services stop at 20 to 25 MB.

LOT 00110/17
ONIONSKINNaming

What the files are called

The pattern takes {file}, {name} and {date}.

It defaults to {file} - {name}. Characters that break paths are stripped, and long names are cut on a character boundary to fit the 255 byte filename limit.

Nothing is ever overwritten silently. A name already in the folder gets (2), then (3), including when a previous run left it there, and the results panel says how many copies were renamed.

LOT 00111/17
ONIONSKINTracing
The second half

Tracing a copy

  1. Open Trace a copyThe second tab. This is what the codes are for.
  2. Type the code, or drop the filePartial is fine, case does not matter, the hyphen is optional. Or drop the leaked PDF itself.
  3. Read the sentenceCopy 6JAS-FA went to Jane Roe on 14 March 2026, from THE LONG WEEKEND. If the copy is still where it was written there is a button to show it in the Finder. If it has moved, the result says so rather than offering a button that opens onto nothing.
Dropping a file works twice over

The app reads any code out of the text layer, and separately matches the file against the hashes it recorded when it wrote it. The second way still works on a flattened copy with no text in it at all.

LOT 00112/17
ONIONSKINThe record

What every run writes

In the output folder
watermark-manifest-YYYY-MM-DD-HHMMSS.csv, one row per copy, opens in Numbers and Excel. A .json sidecar carries the same data for lookup.
Each row holds
Run ID and time, recipient, copy ID, source filename and its SHA-256, output filename and folder and its SHA-256, the style, whether the copy was flattened and at what quality, whether permission flags were applied, and the app version.
Kept durably at
~/Library/Application Support/Onionskin/history.json, capped at 5,000 runs and pruned oldest first. File › Show Run History in Finder opens it.
Why the folder is written with a tilde

A manifest may be handed to a lawyer or a studio. A full path would carry your account name into a document leaving the machine.

LOT 00113/17
ONIONSKINKeyboard
Reference

Menus and keys

  • ⌘OAdd Scripts
  • ⌘↩Watermark. Runs the batch.
  • ⇧⌘RShow Output in Finder
  • MenuFile › Show Run History in Finder
  • ⌘,Settings
  • MenuHelp › Check for Updates. Opens a page in your browser; the app never contacts a server on its own.
LOT 00114/17
ONIONSKINLimits
Stated plainly

What it does not do

  • Watermarking is a deterrent and a tracing aid. It does not stop a script being copied, forwarded or photographed, and a determined person may be able to remove or obscure a mark.
  • The permission flags are advisory. Preview honours them, many other tools do not.
  • Flattened output is not text-searchable. That is the trade for a mark that cannot be selected and deleted.
  • Trace only knows about runs made on this Mac. There is no server holding a copy of your history, by design.
  • Record keeping can be switched off in Protection. It defaults on, because without it a code found on a leaked page cannot be matched to anyone.
LOT 00115/17
ONIONSKINWhere things live
Housekeeping

Where things live

Run history
~/Library/Application Support/Onionskin/history.json
Settings
UserDefaults, under WatermarkSettings.v2. A v1 payload from version 1.0 is migrated on first launch and left in place, so rolling back loses nothing.
Your copies
Wherever you chose. The app never moves or deletes them afterwards.
If you rename or move the app

The history moves with it. The migration is covered by three tests, because losing it would empty the one feature whose whole job is answering who leaked this.

LOT 00116/17
ONIONSKIN
Onionskin

Lot 001 of the Oddlots catalogue. Made by Flamingo Films, LLC.

Pay once. No subscription, no account, no licence server, and no upgrade fee later.

The app makes no network connection of any kind. Check for Updates opens a page in your browser, so it does not know your version or that you exist.

ODDLOTS17/17