New Sign-in Security Alert

Click any text to edit it right here · click an image or link to jump to its setting

  • Replace the placeholder links: Header link, Button link, Help centre link.

New Sign-in Security Alert — Free Responsive HTML Email Template

Transactional · v1.0.0 · Updated 2026-10-20 · Gmail, Outlook & Apple Mail · Dark mode

Tagssecurity alertnew sign inlogin alertnew deviceaccount securitysaastransactional
Updated October 16, 2026

What's included

Features

Shield badge and "New sign-in" headline
Device, browser, location, IP address and time
"If this was you" reassurance line
"If this wasn't you" warning with a clear next step
Bulletproof "Secure my account" button
Optional security tips list
Names the account with an email merge tag
Light and dark palettes, both editable
Transactional footer without marketing content
Plain-text version with every sign-in detail

About this template

New Sign-in Security Alert — Free Login Alert Email Template

New Sign-in Security Alert template: A login alert for apps and SaaS: a shield badge, "New sign-in to your account", the device, browser, approximate location, IP address and time in a details box, a calm "if this was you, no action needed" line, a "Secure my account" button and short security tips.

New Sign-in Security Alert is a free, responsive HTML template for telling users their account was accessed from a new device or location. Login alerts are a standard security practice for apps, SaaS products, banks and marketplaces: they let people spot account takeovers early, often before any damage is done.

Calm, clear and actionable

The email opens with a shield badge and a plain headline, "New sign-in to your account", then shows exactly what happened in a details box: the device, browser or app, approximate location, IP address and time. Two short lines handle both cases without alarm: if it was you, there's nothing to do; if it wasn't, one button secures the account. A short list of security tips closes the email.

Designed to be trusted

Security emails are a favourite target for phishing, so this template follows the habits that make real alerts recognisable: it names the account with the user's email address, shows specific details instead of vague warnings, avoids attachments, and reminds users that you will never ask for their password by email or phone. Make sure the button links only to your own domain.

Works with your auth stack

Copy the HTML into Auth0, Clerk, Supabase, Firebase, Stytch or your own backend and fill the details from the sign-in event (user agent, IP geolocation and timestamp). It's transactional, so no unsubscribe link is needed. Pair it with Magic Link Sign-in, Password Reset and Verify Email for a complete set of account emails.

Why use it

Why Use the New Sign-in Security Alert Template

🛡
Stops takeovers early
Users who see an unfamiliar sign-in can secure their account within minutes, often before anything is changed.
🔍
Specific, not scary
Exact device, location and time details let people decide quickly whether it was them, without panic.
✔
Looks legitimate
Naming the account and reminding users you never ask for passwords helps them tell real alerts from phishing.

How it’s different

How It’s Different From Other Free Email Templates

</>
Real email HTML you own
Not a locked design inside a sending platform. Copy production-ready HTML, download a .html file or fork it into My Code, and use it with any email service or your own code.
⚙
Coded for real inboxes
Tables, inline styles, Outlook conditional comments, a VML button and Outlook font fixes. Many free templates only look right in a browser.
◐
Dark mode built in
Separate, editable light and dark palettes, with a dark preview, instead of leaving dark mode to each email client.
✓
Checks before you send
Warnings for Gmail clipping, missing alt text, placeholder links, images that aren't hosted online, and a missing unsubscribe link or postal address.
Plain-text version included
A matching plain-text version is generated as you edit, ready for multipart emails and the clients and filters that read text.
◍
Free and private
No account, no watermark and no limits. Everything runs in your browser, and your edits are saved locally for next time.

Step by step

How to Use

  1. 1
    Pick your email platformChoose Mailchimp, Klaviyo, HubSpot or Brevo under Merge tags so first names and unsubscribe links export in its syntax, or keep plain {{first_name}} tokens.
  2. 2
    Edit the contentFill in the message & button, sign-in details and security tips, or click any text in the preview to jump to its field. Switch the security tips on or off.
  3. 3
    Add your brandUpload or paste your logo, set the brand colour and the light and dark palettes, pick fonts, or apply your saved brand kit.
  4. 4
    Preview and checkSwitch between desktop, mobile and dark mode, and fix anything the pre-send checks flag, such as placeholder links or missing alt text.
  5. 5
    Export or forkCopy the HTML into Postmark, SendGrid, Amazon SES, Resend or your own code, copy the plain-text version, download a ZIP with images, or fork it into My Code.

Real-world uses

Common Use Cases

💻
New device sign-in alerts
Send it automatically whenever an account is accessed from a browser or device you have not seen before, with the details from the login event.
🌍
Unusual location warnings
Trigger it when a sign-in comes from a new country or region, changing the headline to "Sign-in from a new location".
🔑
Account change notifications
Reuse the layout for password changes, new two-factor devices or email address changes, so users always know when their account changes.
🏦
Fintech and marketplace security
Banks, wallets and marketplaces can use it to meet customer expectations for security alerts, with the tips tailored to their product.

Got questions?

Frequently Asked Questions

Which account was accessed, the device or browser, the approximate location, the time and ideally the IP address, a clear "if this was you, do nothing" line and a single button to secure the account if it was not.

Read the user agent from the sign-in request for the device and browser, look up the IP address with a geolocation service for an approximate city and country, and record the timestamp in the user's time zone.

Send from your normal domain with SPF, DKIM and DMARC set up, name the account, show specific details, never ask for a password in the email and only link to your own domain.

No. It is a transactional security notice about the user's account, so CAN-SPAM's unsubscribe rule does not apply, and users should keep receiving it.

No. Alert on new devices, browsers or locations; alerting on every sign-in trains users to ignore the emails.

It saves an editable copy of your New Sign-in Security Alert in My Code, the UI Snippets code editor: the email markup goes in the HTML panel and its CSS (mobile and dark-mode rules plus fonts) in the CSS panel, so you can keep refining the code and save your own versions.

Yes. It is free for personal and commercial email, with no sign-up and no watermark. Everything runs in your browser, and your edits are saved locally.