How to sync a desktop calendar and address book over CalDAV and CardDAV
CalDAV and CardDAV are the open protocols many calendar and contact services use, and they let a desktop program keep the same events and the same people as your phone. Setting one up comes down to the server’s address and, on many services, an app password. Here is where to find both, and what happens when two devices change the same thing.
9 October 2026 · 8 min read
What CalDAV and CardDAV are
Both are built on WebDAV, an extension of the web’s HTTP that lets a program read and write files on a server. CalDAV (RFC 4791, 2007) keeps calendars that way and CardDAV (RFC 6352, 2011) keeps address books. On the server a calendar is a folder, called a collection, and each event in it is a small file in iCalendar format, the same .ics that comes attached to an invitation. An address book is a collection of vCards, one .vcf per person.
Every item carries an ETag, a tag the server changes whenever the item changes. A program that syncs remembers the tags it last saw. To catch up, it asks for the current tags and fetches only the items whose tag has moved. To save a change, it sends the item with a condition attached: replace this only if its tag is still the one I have. If somebody changed the item in the meantime the server refuses, and the program has to decide what to do next. That condition is what stops a phone and a desktop quietly overwriting each other.
Because the files are standard, the server and the programs can come from different makers: an event added in Thunderbird shows up in Calendar on an iPhone.
Subscribing to a calendar link, an address ending in .ics, is something else. The program fetches a published copy every so often. You can read it, but you cannot change it, and nothing you do goes back.
Which services offer them
Many calendar and contact services offer both. The ones people ask about most:
- iCloud. Calendars are at caldav.icloud.com and contacts at contacts.icloud.com. The user name is usually the email address of your Apple Account, and the password has to be an app-specific password, described below.
- Fastmail. Calendars are at caldav.fastmail.com and contacts at carddav.fastmail.com. Sign in with your full email address and an app password made in Fastmail’s settings.
- Nextcloud. Both live under your own server’s address followed by /remote.php/dav. In the Calendar app, the settings at the foot of the calendar list have a button that copies the CalDAV address, and in Contacts each address book has a Copy link entry in its menu.
- Synology, mail hosts and small servers. Synology’s Calendar and Contacts packages offer both. So do mail hosts such as mailbox.org and Posteo, and servers you can run yourself such as Radicale and Baïkal. Each gives its address on its own help pages.
- Google. Google Calendar and Google Contacts speak both protocols, but Google expects a program to sign in through Google’s own sign-in window (OAuth) rather than with a typed password. Thunderbird and DAVx⁵ both sign in that way. A program that only asks for a user name and password generally cannot connect.
- Microsoft. Outlook.com and Exchange offer neither protocol. An Outlook calendar can be published as a read-only .ics link, and a gateway such as DavMail can stand in front of Exchange for programs that need CalDAV.
Finding the server address
Start with the plain host name, such as caldav.fastmail.com. RFC 6764 gives every server a well-known address, /.well-known/caldav and /.well-known/carddav, that points a program to your own calendars and address books. A server set up properly answers it, and you never need to type a long path.
If the program says it found nothing, try the full address from the service’s help pages, and after that the link of one calendar or address book. A link to a single collection brings in that collection alone, which is also how you sync some calendars and leave others out.
A few causes of “nothing found” come up again and again:
- The address of the service’s website, where the calendars live somewhere else. Nextcloud is the usual case. Its calendars are under /remote.php/dav, and the well-known address only works if whoever runs the server set the web server up for it. Nextcloud’s administration overview warns when that is missing.
- http:// in front of a server that only answers on https://.
- The wrong user name. Most services want the whole email address, including the part after the @.
- The account’s main password where the service wants an app password. The server answers exactly as it would to a wrong password, so the message rarely says which it is.
App passwords
An app password is a long random password the service makes for one program. It signs that program in without your main password and without the code from your phone, and it can be withdrawn on its own. Services with two-step sign-in ask for one because a program syncing in the background has nowhere to show you a code prompt.
Apple calls them app-specific passwords. Sign in at account.apple.com, open Sign-In and Security, then App-Specific Passwords, and label the new one with the program and computer it is for. Two-factor authentication has to be on. Apple shows the password once, so paste it straight into the program. Changing your Apple Account password later withdraws every app-specific password at once, and each program then needs a new one.
Fastmail and Nextcloud work the same way from their own settings. In Nextcloud they are under Security, in the Devices & sessions section, with a button to create a new app password.
Make one per program and per computer. When a laptop is sold or a program dropped, withdraw its password and leave the rest alone.
What syncs, and what does not
An event travels whole: its repeats and the exceptions to them, its reminders, the people invited and its time zone. A contact does too, photo included, with every number and address it has. What differs between programs is what each one shows and keeps.
- Tasks. CalDAV can hold to-do items as well as events, often in lists of their own, and not every program shows them. Apple’s Reminders, once upgraded in iOS 13, stopped syncing over CalDAV altogether.
- Contact groups. iCloud keeps a group as a card of its own that lists its members, while Nextcloud and many others mark each contact with a category. Groups made on one kind of server do not always survive a move to the other.
- Fields a program does not show. A careful client keeps what it does not understand and sends it back unchanged. A careless one drops it on the first edit.
- Changes as they happen. The protocols have no push of their own, so a desktop program asks the server every few minutes. A change made on the phone shows up at the next check.
What a conflict looks like
The usual case: you move a meeting on your phone, and before the desktop has synced you change the same meeting there. The desktop sends its version with the old tag, the server refuses it with 412 Precondition Failed, and the program has to choose. Some programs keep the server’s copy and drop the local change, and others overwrite the server with their own. Few tell you which happened, so after editing the same thing in two places, look at it on both.
A deletion meets an edit in the same way. Delete an event on the phone while the desktop changes it, and depending on which syncs first the event either stays deleted or comes back with the change.
Duplicates are a different problem, and more common. They usually come from importing: the same .ics brought into a synced calendar twice, or a program that uploads its own copy of everything when an account is added to it again. Before connecting a new program for the first time, export each calendar to an .ics file and the address book to a .vcf, so there is something to go back to.
An event an hour out on one device has a time zone problem: usually it was saved with no zone, or with one the other program does not recognise. Set the zone where the event was made.
Our own product, disclosed
Where our own software comes into this
Since version 1.29.8, Calendar and Contacts in Rutba Office keep accounts on a CalDAV and CardDAV server in step. Home → Accounts takes the server’s address with a user name and password (an app password, where the service gives one). It tries the well-known address first, so a plain host name is usually enough, and it also takes the address of a single calendar. Each calendar it finds appears beside your own, and each card joins the address book. In Contacts you choose whether a new card stays on this computer or goes to one of the account’s address books. The password is kept encrypted by the operating system’s own key store.
A sync sends what changed here first, each item with the tag it was last seen with, as described above. When the server’s copy changed in the meantime, the server’s copy wins: it comes back and replaces the change made here, and Sync now in the Accounts window says how many items were kept as the server had them. Then only what changed on the server is fetched. Syncing runs when an account is added, on Home → Sync, a few seconds after a change made here, and every quarter of an hour while the suite is open. Removing an account takes its calendars and cards off this computer and touches nothing on the server. Anything in an event or a card that the suite does not use is kept and sent back with it.
What it does not do: it signs in with a user name and password only, so Google’s calendars and contacts, which want Google’s own sign-in window, cannot be added, and Microsoft’s have no CalDAV to add. It brings in events and leaves tasks on the server. A calendar made here with View → New calendar stays on this computer, so make new calendars on the service and they arrive at the next sync. One account is one address: if a service keeps contacts at a different address from calendars and they do not come in together, add the contacts address as a second account. Plain http is accepted only for a server on the same computer.
Related
How to import and clean data in a spreadsheet with Power Query
Power Query, the Get & Transform tool in Excel, records each change you make to imported data as a step, and runs every step again when the source changes. It earns its place on a report rebuilt from the same export every week or month. For a one-off tidy of data already in the sheet, a formula is often quicker.
How to automate a spreadsheet with scripts, and run them safely
A script is a short program that does to a workbook what you would otherwise do by hand, in the same order every time. In Excel the current way to write one is Office Scripts, recorded or typed. Before you run any script, and especially one somebody sent you, the question to ask is what it can reach beyond the workbook.
How to open a .pst file without Outlook
A .pst is a complete mail archive in one file, and almost nothing outside Microsoft Outlook can read one. Here is what is actually inside it, what your options are, and which of them will lose data.
Free alternatives to Microsoft Office, honestly compared
There are four serious ones and they are good at different things. The right answer depends almost entirely on who receives your files and whether you need to work offline.
Ten apps, one free download
No account, no telemetry, and it works with the network switched off.