When someone tries to steal your account, they rarely kick the door down. They start a password reset.

That "Reset your password?" email you glance at and delete? It's often the first knock. If you don't notice it, you don't know you're being probed until it's too late.

Most people get these emails scattered across a dozen inboxes. Gmail here, an old Yahoo account there, a work address you barely check. There's no single place that says: someone tried to reset three of your accounts in the last hour. That pattern is the alarm. And nobody sees it.

So build the place yourself.

What a reset log actually does

A password reset log is a simple record. One row per reset request. It captures four things: which account, what date and time, whether you started it, and the source (the email, an SMS, an app notification).

When you log them all in one spot, patterns jump out. One reset you requested? Normal. Four resets across unrelated services at 2 a.m. that you never touched? That's an attacker walking down your list of accounts, trying the front doors.

The no-code version

You don't need a server to start. You need discipline.

  • Every time a reset email lands, add a row before deleting it.
  • Log account, timestamp, and "me" or "not me."
  • Review the list once a week.

A plain spreadsheet works. But spreadsheets live in the cloud you're trying to escape, and they're easy to forget.

The self-hosted version

Run a lightweight database app on a spare machine or a Raspberry Pi. Good beginner options:

  • NocoDB — turns a database into a friendly spreadsheet you control. Add columns for account, date, source, and a checkbox for "I requested this."
  • Baserow — same idea, clean interface, runs in one Docker container.

Both let you filter and sort. Ask them to show every "not me" entry from the past week. If the list has more than a couple of rows, take it seriously.

Turn it into an early warning

Here's the trick that makes it worth the effort. Set up email forwarding rules on each account. Any message with "reset," "verify," or "security code" in the subject gets auto-forwarded to one dedicated inbox.

Then you only watch one place. When two forwards arrive close together for different services, that's your signal to change passwords and turn on two-factor authentication right now.

Why this beats trusting your gut

Attackers count on you being busy. One reset email looks like spam. Ten of them, spread over your accounts and days, tell a story your tired eyes miss. A log doesn't get tired.

Your one move today: Create a single inbox or table, and log the next reset email you receive instead of deleting it. That first row is the start of your alarm system.