What is an HLR lookup? The live query behind whether a number rings

You searched "what is an HLR lookup" because something in your stack needs to know whether a phone number actually rings — not just whether it's shaped like a valid number. Those are two different questions, and the gap between them is exactly what an HLR lookup fills. This post explains what the HLR is, what a lookup against it tells you, how it differs from the metadata you can get for free, and — plainly — which of these Boundstone does and does not do today.

What the HLR is#

HLR stands for Home Location Register. It's a central database inside every mobile carrier's core network that holds the live record for each subscriber the carrier owns: which SIM belongs to which number, which plan is active, and — critically — where that subscriber is currently registered on the network, including whether they're roaming on another operator right now.

When you place a call or send an SMS to a mobile number, the network queries the HLR (and its companion, the VLR, or Visitor Location Register) to work out where to route it. The HLR is authoritative because it is the network's own source of truth. Nothing outside the carrier knows whether a number is currently switched on and reachable — because nothing outside the carrier is the carrier.

An HLR lookup is a live query#

An HLR lookup (or "HLR dip") is a query sent into that signalling network — historically over SS7, today usually through an aggregator's API — asking the HLR about one specific number. Unlike a table lookup, it touches live infrastructure, and it comes back with things only the network knows:

• Whether the number is active — assigned to a live subscriber, not disconnected.
• The current serving carrier — who actually operates the number today, after any porting.
• Reachability and roaming status — whether the handset is currently registered, and if so, whether it's roaming.

That's the whole value: an HLR lookup is the only way to learn that a number rings. It's also why it costs money per query — you're paying for a round trip into a carrier's core network, not a lookup in a file you already downloaded.

Why metadata can't tell you this#

Most phone validation you'll reach for first is metadata, not a live query. Google's libphonenumber ships each country's published numbering plan as data and matches a number against it. That's genuinely useful and, for plenty of jobs, all you need — it's how you get format, country, and line type for free, offline, with no per-call cost:

import { parsePhoneNumber } from 'libphonenumber-js/max'

const phone = parsePhoneNumber('+16504472983')
console.log(phone.isValid())   // true — the number fits its plan
console.log(phone.getType())   // 'FIXED_LINE_OR_MOBILE'

But notice what isValid() means: the number could exist under its country's plan. It does not mean anyone holds it, that it hasn't been disconnected, or that a phone would answer. Metadata describes how a number's range was designated — it cannot see the live network. There's a fuller walk-through of the metadata path in validating phone numbers in JavaScript. When you need to know a number is live, metadata has nothing more to give you. That's the HLR's job, and only the HLR's.

HLR lookup vs carrier lookup vs ported status#

These three get muddled, so they're worth separating:

• Carrier lookup answers "which network operates this number now." Because of number portability, the carrier a range was originally assigned to often isn't the one serving it today — a carrier lookup resolves the current operator.
• Ported status answers the narrower "has this number moved away from its original carrier."
• HLR liveness is the fullest of the three: is the subscriber active and reachable at this moment.

All three are live queries against network data, and all three bill per lookup. Metadata gives you none of them — it can only report the original designation, which drifts from reality the moment a number is ported or disconnected.

What Boundstone does today — and what it doesn't#

Here's the honest boundary. Boundstone does metadata-grade phone validation today, and nothing that requires a live network dip. Every phone response carries the checks it did and didn't run, so a valid: true never overstates itself:

{
  "valid": true,
  "e164": "+16504472983",
  "country": "US",
  "line_type": "fixed_line_or_mobile",
  "national_format": "(650) 447-2983",
  "checks": {
    "performed": ["format", "region", "line_type_metadata"],
    "not_performed": ["carrier_lookup", "ported_status", "hlr_liveness"]
  }
}

checks.performed is ["format", "region", "line_type_metadata"]. checks.not_performed is ["carrier_lookup", "ported_status", "hlr_liveness"] — the three live queries above, named explicitly. Boundstone does not perform HLR liveness, carrier lookup, or ported-status detection by default, and the response says so instead of leaving you to assume. Those live checks are a paid opt-in: send hlr:true and the dip runs for 5 credits, priced against what a real dip costs — an HLR query bills per call — and refunded when the network cannot answer.

Anyone who hands you a confident "this number is active" without showing you a live check either ran one (and should say so) or is guessing off metadata and calling it reachability. The not_performed list exists so you never have to wonder which.

The short version#

• HLR = Home Location Register, the carrier's live database of who owns a number and where they're registered.
• An HLR lookup is a live network query — the only way to know a number is active, which carrier serves it now, and whether it's reachable. It costs per dip because it touches carrier infrastructure.
• Metadata (libphonenumber) can't tell you any of that. It validates the shape and designated type of a number, offline and free. Start there — it's often the whole job.
• Boundstone is metadata-grade by default, live on request. hlr_liveness, carrier_lookup and ported_status come back not_performed unless you send hlr:true, which runs a real dip for 5 credits and refunds it when the network cannot answer.

Want the metadata layer now, with the honesty contract on every response? The keyless phone validator runs it with no signup and no card.