Curve25519 is the Montgomery curve y² = x³ + 486662x² + x over the prime 2^255 − 19, designed by Daniel J. Bernstein in 2006 and specified in RFC 7748. Its group has order 8·n with a 253-bit prime n, giving about 128 bits of security, and its quadratic twist is also secure.
X25519, the Diffie–Hellman function on this curve, uses u-coordinates only: keys are 32-byte strings, and private keys are 'clamped' as RFC 7748 §5 prescribes so that the cofactor cannot leak information. The function accepts any 32 bytes as a public key; low-order inputs give an all-zero shared secret, which protocols should reject.
TLS 1.3 lists x25519 as a Recommended group and uses it as the classical half of the X25519MLKEM768 hybrid; SSH uses it as curve25519-sha256 (RFC 8731), and WireGuard, Signal and age are built on it. Its twisted Edwards twin is edwards25519, used for Ed25519 signatures.