At 3:14 am on a Tuesday in April, a TLScontact slot opened at the London Holborn centre. It was gone by 3:14:22 am. No human caught it. An auto-book extension running in the background caught it — filled the form, submitted, confirmed the booking, and sent a notification. The applicant woke up to a confirmation email.
That is the best-case scenario for auto-book technology. This article explains how it actually works, what makes it safe or unsafe depending on the tool, how success-fee pricing changes the incentive structure, and what the grey areas are around TLScontact's terms.
How Auto-Book Extensions Actually Work: The Technical Flow
A browser extension has access to the DOM — the full structure of any webpage it has permission to run on. For TLScontact, this means the extension can read the appointment calendar, detect when a slot appears, identify the form fields, fill them with pre-configured values, and submit the form — all programmatically, without visible mouse clicks.
The sequence for Visa Master Premium looks like this:
- Monitor: The extension polls the TLScontact appointment calendar every 20–40 seconds using a Chrome service worker.
- Detect: The DOM detector checks for available slot elements matching your configured preferences (date range, centre, appointment type).
- Authenticate: If TLScontact has logged you out (sessions expire, sometimes after as little as 30 minutes of inactivity), the extension re-authenticates using your stored TLS credentials before attempting to book.
- Fill: The booking form is filled with your pre-configured applicant details.
- Submit: The form is submitted. TLScontact processes it and returns a confirmation or error.
- Notify: You receive a desktop notification and Telegram message with the booking confirmation.
- Capture: The £19 success fee is initiated via Stripe. You have a 24-hour window to claim a refund if needed.
The key dependency is step 3: the extension needs your TLScontact credentials to re-authenticate when sessions expire. This is where most of the safety questions live.
Where Your Credentials Actually Go
This is the most important question to answer before installing any auto-book tool.
| Tool | Credential storage | Transmitted to vendor? |
|---|---|---|
| Visa Master Premium | AES-GCM encrypted, local device only | ❌ Never |
| VisaReady | Not publicly documented | Unknown |
| TLSContact Appointment Booker | Not publicly documented | Unknown |
For Visa Master Premium, the credential handling is explicitly documented in the extension's architecture: your TLScontact email and password are encrypted using AES-GCM with a key derived via PBKDF2 from a per-install random salt. The encrypted blob is stored in chrome.storage.local — accessible only to the extension on your device. It is never transmitted to torly.ai. You can verify this in the open-source components of the extension.
The only data that reaches torly.ai servers from Visa Master Premium is: your installId (a random UUID generated at install — not linked to your identity), your Stripe email at the point of payment, the bookingId after a successful booking, and the slot timestamp and centre for receipt and Telegram echo. Not your TLS password. Not your session token. Not the contents of the booking form.
For VisaReady and TLSContact Appointment Booker, the credential handling model is not publicly documented to this level of detail. Before providing your TLScontact login credentials to any service, you should ask: where are they stored, who has access, and what happens if the company closes? The full comparison of extension privacy models covers this in more depth.
How Success-Fee Pricing Changes the Game
Subscription-based tools charge you regardless of outcome. Success-fee tools charge only when they deliver.
| Pricing model | You pay if no slot found | You pay if slot found | Incentive alignment |
|---|---|---|---|
| Subscription (VisaReady, Booker) | ✅ Yes | ✅ Yes | Neutral — vendor paid either way |
| Success fee (Visa Master Premium) | ❌ No | ✅ Yes (£19) | ✅ Aligned — vendor only earns on delivery |
The practical implication: a success-fee tool has a financial reason to find you a slot. A subscription tool has a financial reason to retain your subscription — which may or may not correlate with finding you a slot.
This does not mean subscription tools are bad. It does mean that if a subscription tool has not found you a slot after several weeks, you are subsidising the service without receiving the outcome you need. With a success-fee model, the worst case is you spend several weeks running the tool, find no slot, and owe nothing.
Visa Master Premium's £19 success fee is charged at the point of booking via Stripe. There is a 24-hour refund window — relevant if the slot confirmation turns out to be for a centre or date you cannot use, or if TLScontact cancels the booking on their end. The refund mechanics on TLScontact are covered in a separate piece.
Is Auto-Booking Allowed? The Honest Grey-Area Answer
TLScontact's Terms of Service, accessible on their website, do not contain a specific prohibition on browser automation or extensions that interact with the booking form on your behalf. This is meaningfully different from a clear prohibition.
What TLScontact does prohibit is commercial slot resale — selling appointment slots to third parties. An extension that books a slot into your own authenticated account for your own visa application is a different act from a reseller who books slots to sell them on.
Auto-booking extensions operate in your own browser session, authenticated with your own account, filling in your own applicant details, booking into your own TLScontact profile. The legal and policy characterisation of this is ambiguous, not clear-cut.
Our honest guidance: read the current TLScontact Terms of Service before enabling auto-book. The situation may change if TLScontact updates their terms in response to widespread extension use. Visa Master will update its documentation if the policy landscape changes materially.
What you should not do: rely on legal or policy ambiguity as permanent cover. If TLScontact adds a specific prohibition on automated booking, that changes the risk calculation.
What Auto-Book Cannot Guarantee
Auto-book extensions notify you when they successfully complete a booking — but booking an appointment is not the same as being granted a visa. A few important caveats:
- Visa issuance is decided by the French consulate, not TLScontact. Booking an appointment is a prerequisite, not a guarantee of a positive outcome.
- TLScontact system errors occasionally reject valid bookings. The extension notifies you but cannot force TLScontact to honour a technically successful submission.
- Slot preference mismatches: If you configure the extension too broadly (accepting any centre, any date range), it may book a slot that is technically valid but logistically inconvenient. Configure your preferences carefully before enabling auto-book.
- Session expiry during booking: If TLScontact's login session expires at the exact moment of form submission, the booking attempt may fail. The extension handles re-authentication, but there is a small window of vulnerability.
The booking FSM fails-safe: if any required form element is missing or the selector does not match, the extension aborts the booking attempt without submitting a partial form.
Setting Up Auto-Book Safely
If you decide to enable Visa Master Premium, the recommended setup sequence is:
- Install the extension and run it in Free mode for a few days to confirm it is correctly detecting your TLScontact session.
- Configure your slot preferences specifically: target centre(s), acceptable date range, appointment type. Narrower preferences reduce the chance of an unwanted booking.
- Enable Premium. The extension will prompt for your TLScontact credentials, explain how they are stored (encrypted locally), and confirm what data is sent to torly.ai.
- Enable Telegram notifications so you receive the booking confirmation on your phone immediately.
Save the £19 success fee until you actually book — install Visa Master Free from the Chrome Web Store first, then upgrade to Premium when you are ready to enable auto-book.
For the complete privacy architecture — what the extension reads, what it stores, what it transmits — read How Visa Master Watches TLScontact Without Touching Your Login. For the Telegram notification setup, see France Visa Telegram Notifications: Setup Without Sharing Your Account.
- france-visa
- auto-book
- visa-master
- chrome-extension