Mozilla Thunderbird is a free, open-source desktop email client that can work with much more than email. Modern Thunderbird releases include native support for CardDAV, an open Internet protocol designed to synchronize address books and contact information between servers and client applications.

For organizations using Google Workspace, CardDAV provides a practical way to make Google Contacts available inside Thunderbird. Once configured correctly, users can access their Google contacts while composing email and can keep supported contact information synchronized between Thunderbird and Google.

This is significantly better than periodically exporting contacts from Google Contacts to CSV and importing them into Thunderbird because CardDAV creates a synchronized address book rather than a static copy.

This guide explains the architecture, recommended configuration, OAuth authentication, security considerations, synchronization behavior and common troubleshooting procedures.

1. What Is CardDAV?

CardDAV is an open protocol designed specifically for accessing and synchronizing contact information over a network.

It is based on WebDAV technologies and normally operates over HTTPS.

A CardDAV environment essentially contains:

CardDAV Server

Stores the authoritative address book.

In this case, Google provides the server-side contact service.

CardDAV Client

Connects to the server, reads contacts and submits supported changes.

Mozilla Thunderbird acts as the client.

The basic architecture is:

Google Contacts / Google Workspace

↓

Google CardDAV Service

↓

HTTPS + Authentication

↓

Mozilla Thunderbird

↓

Thunderbird Address Book

Instead of maintaining two unrelated copies of an address book, Thunderbird communicates with Google's service to maintain synchronization.

2. CardDAV vs CSV Contact Import

These two methods should not be confused.

CSV Import

A CSV import creates a snapshot of the contacts at the time of import.

For example:

Google Contacts → Export CSV → Import into Thunderbird

If a contact is subsequently changed in Google Contacts, the imported Thunderbird copy normally does not automatically receive that change.

CardDAV

CardDAV creates an ongoing connection:

Google Contacts ↔ CardDAV ↔ Thunderbird

Therefore, CardDAV is normally preferable when the objective is continuous contact synchronization.

3. Why Use Google Contacts with Thunderbird?

A synchronized Google address book can be particularly useful for users who use Thunderbird as their primary desktop email application.

Advantages include:

• Access Google Contacts directly from Thunderbird.
• Reduce repeated manual CSV imports.
• Maintain a more consistent contact database.
• Edit supported contact information from the desktop client.
• Use Google contacts while composing messages.
• Centralize contacts in Google rather than maintaining isolated local address books.
• Keep contacts accessible through other Google-connected devices.
• Reduce errors caused by outdated locally imported contact lists.

For business environments, centralized contact storage is particularly useful when employees work from multiple computers or devices.

4. Requirements Before Starting

Before configuring synchronization, verify the following:

Thunderbird

Use a reasonably current version of Mozilla Thunderbird.

Modern Thunderbird releases contain native CardDAV support, so a third-party extension is normally unnecessary for basic Google Contacts synchronization.

Google Account

You need either:

• A personal Google/Gmail account, or
• A Google Workspace account.

Internet Connection

Thunderbird must be able to reach Google's HTTPS services.

Browser-Based Google Authentication

Google may open an OAuth authorization window during configuration.

Do not block this window.

Cookies

OAuth authentication may depend on browser/session cookies. Excessively restrictive cookie settings in Thunderbird can therefore interfere with Google authentication.

5. Do You Need to Enable the CardDAV API in Google Cloud Console?

For ordinary Thunderbird contact synchronization, users generally should not start by creating a Google Cloud project or manually enabling an API.

Thunderbird's built-in Google/CardDAV integration is intended to handle normal account authorization through Google's authentication process.

Google Cloud API configuration is a different subject and is primarily relevant to developers creating their own applications or integrations.

Therefore, for a standard user configuring Google Contacts in Thunderbird:

Start with Thunderbird's native CardDAV configuration.

Do not unnecessarily create API credentials, OAuth clients or Google Cloud projects.

6. Recommended Method: Add Google Contacts Using Thunderbird's Built-In CardDAV Support

The exact menu wording can differ slightly depending on the Thunderbird version.

Step 1 – Open Thunderbird

Start Mozilla Thunderbird.

If the Google Workspace mailbox is already configured for email, you can continue using the same Thunderbird installation.

Email configuration and CardDAV address-book configuration are separate functions.

Step 2 – Open Address Book

Open:

Address Book

from Thunderbird.

Depending on the version, you may see an Address Book icon in the application interface.

Step 3 – Create a CardDAV Address Book

Look for an option similar to:

New Address Book

and select:

Add CardDAV Address Book

or:

CardDAV Address Book

The terminology may differ slightly across Thunderbird versions.

Step 4 – Enter Your Google Account

Enter your complete Google Workspace email address.

Example:

user@company.com

For a personal Google account:

username@gmail.com

Thunderbird may be able to discover the appropriate Google CardDAV service automatically.

When automatic discovery works, you may not need to manually specify a CardDAV URL.

7. Manual Google CardDAV URL

If automatic discovery does not work, administrators may encounter configurations using Google's CardDAV endpoint.

A commonly used Google Contacts CardDAV format is:

https://www.googleapis.com/carddav/v1/principals/USER-EMAIL/lists/default/

Replace:

USER-EMAIL

with the actual Google account.

For example:

https://www.googleapis.com/carddav/v1/principals/user@example.com/lists/default/

However, automatic discovery should normally be attempted first because it reduces the possibility of errors and is easier to maintain.

8. Authenticate with Google

Thunderbird should initiate Google's authorization process.

A Google sign-in window may appear.

Enter the appropriate Google account credentials.

If the account uses 2-Step Verification, complete the second authentication factor when Google requests it.

Google may then display an authorization screen explaining the access Thunderbird is requesting.

Review the request and approve it if appropriate.

9. OAuth Is Preferred Over App Passwords

This is an important security consideration.

For modern Thunderbird installations that support Google OAuth authentication, use the normal Google authorization process whenever possible.

The preferred flow is:

Thunderbird → Google OAuth → User Authentication → Permission Granted

This avoids storing the user's normal Google password in Thunderbird for CardDAV access.

What About Google App Passwords?

App Passwords are special passwords intended for applications or devices that cannot use Google's modern sign-in mechanisms.

They should not be the first choice when OAuth works.

An App Password may also be unavailable when:

• The Google account does not have 2-Step Verification enabled.
• The organization restricts App Passwords.
• Advanced Protection is enabled.
• Security-key-only authentication policies are being used.
• Workspace administrator policies prevent their use.

Therefore:

Use OAuth first. Use an App Password only when it is genuinely required and permitted by the organization's security policy.

10. Complete the Address Book Setup

After successful authentication, Thunderbird should discover one or more available address books.

Select the appropriate Google Contacts address book and complete the setup.

Thunderbird may display it with a generic name such as:

Address Book

or another Google-related name.

You can verify whether an address book is connected to Google by opening its properties. A CardDAV address book should show remote/CardDAV information rather than behaving like a purely local Thunderbird address book.

11. Test the Synchronization

Never assume synchronization is working simply because the address book appears.

Perform a practical test.

Test 1 – Google to Thunderbird

Open Google Contacts.

Create a test contact such as:

Name: CardDAV Test User

Add a temporary email address.

Wait for synchronization or refresh the Thunderbird address book.

Check whether the contact appears.

Test 2 – Thunderbird to Google

Create or modify a test contact inside the synchronized CardDAV address book in Thunderbird.

Then open Google Contacts.

Verify whether the supported change appears there.

After testing, delete the temporary contact.

This verifies actual synchronization rather than merely confirming successful authentication.

12. Important: Local Thunderbird Address Books Are Different

Thunderbird can contain several address books simultaneously.

For example:

• Personal Address Book
• Collected Addresses
• Google/CardDAV Address Book
• Other manually created address books

A contact saved into Personal Address Book is not automatically the same as a contact saved into the Google CardDAV address book.

This distinction is extremely important.

If you create a contact in the wrong local address book and then wonder why it does not appear in Google Contacts, CardDAV may actually be working correctly.

Always verify which address book contains the contact.

13. Personal Address Book vs Google CardDAV Address Book

Personal Address Book

Stored locally within the Thunderbird profile.

It does not automatically become part of Google Contacts.

Google CardDAV Address Book

Connected to Google's contact service.

Supported changes can synchronize with Google.

Therefore, users who want a contact stored in Google should ensure it is created in the Google/CardDAV address book, not merely the local Personal Address Book.

14. What Is “Collected Addresses”?

Thunderbird can automatically collect email addresses from outgoing messages depending on configuration.

These may be stored in:

Collected Addresses

This is also normally a local Thunderbird address book.

Do not assume every email address suggested by Thunderbird belongs to Google Contacts.

Similarly, Gmail may suggest addresses based on communication history that are not necessarily identical to entries in the user's manually managed Google Contacts list.

This difference can cause considerable confusion during troubleshooting.

15. Does CardDAV Synchronize the Google Workspace Directory?

Not necessarily.

Google Workspace environments may contain different categories of contact information:

1. A user's personal Google Contacts
2. Automatically remembered or suggested addresses
3. Organization/Directory information
4. Other contacts
5. Shared or third-party-managed address books

A CardDAV connection to a user's Google Contacts should not automatically be assumed to expose every person in the organization's Google Workspace Directory.

This is important in organizations with hundreds or thousands of users.

Personal Google Contacts synchronization and Google Workspace Global Directory access are different concepts.

16. Does Thunderbird Need CardBook?

Historically, Thunderbird users often relied on extensions such as CardBook for advanced CardDAV functionality.

Modern Thunderbird releases include native CardDAV support.

Therefore, for basic Google Contacts synchronization:

Built-in Thunderbird CardDAV → Recommended starting point

Third-party add-on → Consider only when a specific additional feature is required

Avoid installing unnecessary extensions because every additional extension introduces another software component that must remain compatible with future Thunderbird versions.

17. How Synchronization Works

A simplified workflow is:

Contact Created in Google

Google Contacts
↓
Google CardDAV service
↓
Thunderbird synchronizes
↓
Contact appears in Thunderbird

Contact Modified in Thunderbird

Thunderbird CardDAV Address Book
↓
Authenticated HTTPS request
↓
Google CardDAV service
↓
Google Contacts updated

The actual synchronization timing can depend on Thunderbird, connectivity, server response and refresh behavior.

Therefore, “sync” should not always be interpreted as a guaranteed instantaneous change visible within one second.

18. Security Architecture

CardDAV synchronization should use HTTPS.

That provides encryption between Thunderbird and Google's service while information is transmitted over the network.

Authentication should preferably use Google's OAuth process.

The architecture becomes:

User

↓

Thunderbird

↓

Google OAuth Authentication

↓

HTTPS

↓

Google CardDAV

↓

Google Contacts

This is substantially preferable to repeatedly entering or storing the user's primary Google account password in unsupported applications.

19. 2-Step Verification and CardDAV

Google Workspace administrators should encourage 2-Step Verification where appropriate.

With OAuth-compatible Thunderbird versions, 2-Step Verification normally does not prevent synchronization.

Instead, the user authenticates through Google and completes the required verification.

Depending on the account's security configuration, Google might request:

• Google Prompt
• Authenticator verification
• Security key
• Passkey
• Another approved second factor

The authentication policy is ultimately controlled by Google and, for managed Workspace accounts, organizational administrator settings.

20. Troubleshooting: Google Contacts Not Appearing

If synchronization is configured but contacts do not appear, check the following.

Check the Correct Address Book

Make sure you are viewing the Google/CardDAV address book rather than only:

• Personal Address Book
• Collected Addresses

Verify CardDAV Properties

Right-click or open the properties of the suspected Google address book.

Confirm that it is a remote/CardDAV address book.

Restart Thunderbird

Close Thunderbird completely and reopen it.

Check Internet Connectivity

Verify that Google websites and HTTPS services are reachable.

Check Authentication

Expired or revoked authorization can prevent synchronization.

Reauthentication may be necessary.

21. Error: “All Address Books for the Specified Account Have Already Been Added”

This message can actually indicate that Thunderbird has already discovered and added the Google address book.

Before attempting another configuration:

1. Open Address Book.
2. Examine existing address books.
3. Look for an entry such as Address Book, Google, or Contacts.
4. Open its properties.
5. Check whether it contains a Google CardDAV URL.

If it does, you may already have Google Contacts configured.

Creating another copy could lead to confusion or apparent duplication.

22. OAuth Window Does Not Open

If Google authentication does not appear:

1. Update Thunderbird.
2. Restart Thunderbird.
3. Check Thunderbird privacy settings.
4. Ensure cookies required for authentication are not blocked.
5. Check firewall or proxy restrictions.
6. Verify that Google authentication pages are accessible.
7. Temporarily test without browser/privacy extensions that might interfere with authentication.
8. Verify the computer's date, time and time zone.

Incorrect system time can sometimes interfere with secure authentication systems.

23. Google Login Works but Contacts Still Do Not Sync

Authentication success and synchronization success are different things.

Check:

Account authorization – Did Google actually grant Thunderbird access?

Address-book selection – Was the discovered Google address book added?

Network connectivity – Can Thunderbird continue reaching Google's service?

Correct address book – Are you creating contacts in the synchronized book?

Google account – Did you authenticate using the intended account?

Users with several Google accounts signed into a browser can accidentally authorize the wrong account.

24. Duplicate Contacts

Duplicate contacts can occur when users have previously:

• Imported Google contacts through CSV.
• Installed an older synchronization extension.
• Created local copies.
• Added the same CardDAV account more than once.
• Migrated Thunderbird profiles.
• Imported old address-book backups.

Before deleting duplicates, determine where each copy is stored.

Do not blindly delete the synchronized CardDAV address book.

A safer process is:

1. Identify local address books.
2. Identify remote CardDAV address books.
3. Back up important contacts.
4. Verify Google Contacts through the web.
5. Remove only confirmed duplicate/local copies.

25. Contacts Missing After Synchronization

If some contacts appear while others do not, investigate whether the “missing” addresses are actually:

• Gmail suggestions
• Other Contacts
• Directory entries
• Automatically collected addresses
• Contacts under a different Google account
• Contacts stored under another label or service
• Local Thunderbird contacts

Do not assume every address Gmail remembers is part of the same CardDAV address book.

26. Thunderbird Says the Address Book Already Exists but It Is Not Syncing

Open the address book's properties.

If it contains a Google CardDAV address, but synchronization has stopped:

1. Verify Google Contacts still exist through the browser.
2. Check network access.
3. Restart Thunderbird.
4. Verify authorization.
5. Update Thunderbird.
6. Back up any important local information.
7. If necessary, remove and recreate the CardDAV connection.

Do not delete the Google Contacts themselves while troubleshooting the Thunderbird connection.

27. Contacts Are Read-Only

If contacts can be viewed but cannot be modified, possible causes include:

• Address-book permissions
• Organization policies
• Authentication scope
• Remote server restrictions
• Directory contacts rather than personal contacts
• Thunderbird or extension problems

A company directory entry, for example, should not be assumed to be editable simply because it appears during contact lookup.

28. Thunderbird Contact Backup

Synchronization is not a replacement for backup.

If contact information is business-critical, maintain an independent backup strategy.

Possible methods include periodically exporting important Google Contacts and protecting the Thunderbird profile according to organizational backup policy.

Remember:

Synchronization ≠ Backup

If a synchronized contact is accidentally deleted and that deletion propagates, synchronization itself may reproduce the deletion rather than protect against it.

29. CardDAV vs IMAP

These protocols serve different purposes.

Protocol	Purpose
IMAP	Email synchronization
SMTP	Sending email
CardDAV	Contact synchronization
CalDAV	Calendar synchronization

Therefore, successfully configuring Gmail or Google Workspace email through IMAP does not automatically mean Google Contacts have been configured.

CardDAV must be configured or discovered separately.

30. CardDAV vs CalDAV

CardDAV handles contacts.

CalDAV handles calendars.

Although both technologies are based on WebDAV concepts, they should not be treated as interchangeable.

For a complete groupware environment:

Email → IMAP/SMTP

Contacts → CardDAV

Calendar → CalDAV or provider-specific integration

31. Recommended Configuration for Businesses

For organizations using Google Workspace with Thunderbird, a sensible configuration is:

Email

Google Workspace + OAuth-supported Thunderbird configuration

Contacts

Google Contacts + native Thunderbird CardDAV

Authentication

OAuth wherever supported

Security

2-Step Verification according to company policy

Backup

Independent backup/export of critical business information

Updates

Keep Thunderbird reasonably current.

Extensions

Install only extensions that provide a genuine business requirement.

32. Administrator Security Recommendations

IT administrators deploying Thunderbird across multiple computers should consider:

• Keeping Thunderbird patched.
• Enforcing Google Workspace 2-Step Verification where appropriate.
• Avoiding storage of primary account passwords in unsupported applications.
• Using OAuth-supported integrations.
• Limiting unnecessary Thunderbird extensions.
• Protecting Windows user profiles.
• Encrypting endpoint storage where organizational policy requires it.
• Removing Google authorization from lost or retired computers.
• Maintaining endpoint security.
• Maintaining reliable backups.
• Training users to distinguish local and synchronized address books.

33. When Should an App Password Be Used?

An App Password should be treated as a compatibility mechanism, not the standard configuration for modern applications capable of Google OAuth.

Consider it only if:

• The software genuinely cannot authenticate through Google OAuth.
• 2-Step Verification is enabled.
• Google permits App Passwords for the account.
• The Workspace administrator allows the method.
• Organizational security policy permits it.

If OAuth works, prefer OAuth.

34. Removing Thunderbird Access from Google

If a computer is retired, lost, reassigned or suspected of compromise, administrators should not rely only on uninstalling Thunderbird.

Review the Google Account's connected applications/security settings and revoke access where appropriate.

For managed Google Workspace accounts, administrators may also have organizational security controls available through the Admin console.

This is especially important for computers previously used by employees who have left the organization.

35. Migration to a New Computer

When replacing a computer, there are two approaches.

Reconfigure CardDAV

Install Thunderbird and reconnect the Google account using CardDAV.

This is usually clean because the authoritative contacts remain in Google.

Migrate the Thunderbird Profile

A full Thunderbird profile migration may preserve email settings, local address books and other configuration.

However, authentication may still require reauthorization on the new system.

Never assume that copying a Thunderbird profile guarantees that every cloud authentication token will continue working.

36. Practical Diagnostic Checklist

If Google Contacts are not working in Thunderbird, verify these items in order:

1. Thunderbird is reasonably current.
2. Internet connectivity is working.
3. Google account login works in a browser.
4. Address Book is open.
5. Google/CardDAV address book exists.
6. Correct Google account was authenticated.
7. OAuth authorization completed.
8. Required cookies are permitted.
9. Contacts exist in Google Contacts.
10. You are viewing the correct Thunderbird address book.
11. The address book properties show CardDAV/Google information.
12. Firewall or proxy is not blocking Google.
13. Thunderbird has been restarted.
14. A test contact has been created.
15. Synchronization has been verified in both directions.

This systematic approach is more effective than repeatedly deleting and recreating accounts.

Frequently Asked Questions (FAQ)

1. Can Thunderbird synchronize Google Workspace contacts?

Yes. Modern Thunderbird versions support CardDAV address books and can connect to Google Contacts.

2. Do I need CardBook to synchronize Google Contacts?

Usually no. Modern Thunderbird releases include built-in CardDAV support. CardBook may still provide additional features for users who specifically require them.

3. Do I need to enable the CardDAV API in Google Cloud Console?

Normally no for standard Thunderbird use. Start with Thunderbird's native CardDAV account discovery and Google authentication.

4. Is CardDAV the same as IMAP?

No. IMAP synchronizes email; CardDAV synchronizes contacts.

5. Is CardDAV the same as CalDAV?

No. CardDAV is designed for contacts, while CalDAV is designed for calendars.

6. Can I use my Google Workspace email address?

Yes. Enter the complete Workspace email address when configuring the CardDAV address book.

7. Should I use my normal Google password?

Use Google's OAuth authorization flow whenever Thunderbird supports it rather than attempting to configure the integration around the primary account password.

8. Do I need an App Password when 2-Step Verification is enabled?

Not normally when OAuth works. App Passwords are mainly intended for applications or devices that cannot use modern Google sign-in.

9. Why can't I create a Google App Password?

Google may not offer App Passwords depending on the account's security configuration, administrator policies, Advanced Protection or authentication method.

10. Are changes synchronized both ways?

A properly configured writable CardDAV address book is intended to synchronize supported contact changes. Test your configuration before relying on it for business-critical information.

11. Why does a contact created in Thunderbird not appear in Google?

Check whether you created it in the Google/CardDAV address book or Thunderbird's local Personal Address Book.

12. What is Personal Address Book?

It is a local Thunderbird address book and should not be assumed to synchronize automatically with Google.

13. What are Collected Addresses?

Thunderbird can collect addresses from outgoing email. These entries may be stored locally and are different from the synchronized Google address book.

14. Why do I see contacts in Gmail suggestions that are not in Thunderbird?

Gmail suggestions can include addresses derived from communication history or other contact sources. They are not necessarily identical to the Google Contacts address book being synchronized.

15. Will CardDAV show every employee in my Google Workspace organization?

Do not assume so. A user's personal Google Contacts and the organization's Workspace Directory are different data sources.

16. Can I configure multiple Google accounts?

Yes, subject to Thunderbird and Google authentication. Each account may appear as a separate address book.

17. Why does Thunderbird say all address books have already been added?

The Google CardDAV address book may already exist. Check existing address books and inspect their properties before adding another one.

18. Why is the OAuth window not appearing?

Check Thunderbird version, cookie/privacy settings, Internet access, proxy/firewall restrictions and system date/time.

19. Can a firewall block CardDAV?

Yes. Network security products, proxies, DNS filters or restrictive firewalls can interfere with access to Google services.

20. Is CardDAV encrypted?

Google CardDAV connections should use HTTPS, providing encrypted transport between the client and server.

21. Does CardDAV work on Windows 11?

Yes. Thunderbird's CardDAV functionality is application-based and can be used on supported Windows installations.

22. Can Thunderbird on Linux synchronize Google Contacts?

Yes, provided the Thunderbird version supports CardDAV and Google authentication succeeds.

23. Can Thunderbird on macOS synchronize Google Contacts?

Yes, using Thunderbird's supported CardDAV functionality.

24. Why do I have duplicate contacts?

Common causes include previous CSV imports, multiple CardDAV configurations, local copies and older synchronization extensions.

25. Should I delete duplicate contacts immediately?

No. First identify which contacts are local and which are synchronized. Back up important data before mass deletion.

26. Is CardDAV synchronization a backup?

No. Synchronization and backup are different. A deletion may synchronize across systems.

27. Should businesses back up contacts separately?

Yes. Business-critical contact databases should have an appropriate independent backup or export strategy.

28. What happens when the Google password changes?

OAuth authorization may continue or may require reauthentication depending on Google's security decisions and account changes. Legacy App Password configurations can also be affected by security changes.

29. Should I use old Thunderbird contact-sync extensions?

Prefer native Thunderbird CardDAV where it meets your requirements. Add extensions only when a specific additional capability is required and the extension is actively compatible with your Thunderbird release.

30. What is the safest authentication method?

For a modern Thunderbird-to-Google integration, Google's supported OAuth authorization is generally preferable to legacy password-based authentication.

Conclusion

Google Workspace and Mozilla Thunderbird can provide an effective combination for organizations that prefer an open-source desktop email client while keeping contacts centralized in Google.

The key is to understand that email and contacts are separate services. IMAP synchronizes email, while CardDAV handles address books.

For modern Thunderbird installations, the recommended approach is generally:

Google Contacts → Native Thunderbird CardDAV → Google OAuth → HTTPS

Users should attempt Thunderbird's built-in CardDAV discovery first rather than immediately configuring APIs, installing extensions or generating App Passwords.

For reliable business use, administrators should also maintain good endpoint security, use modern Google authentication, keep Thunderbird updated, distinguish local address books from synchronized Google contacts and maintain independent backups of important contact information.

#tags