Edwards25519 is −x² + y² = 1 + dx²y² over 2^255 − 19 with d = −121665/121666. It is birationally equivalent to Curve25519, so both share a group of order 8·n. Its addition law is complete — there are no exceptional cases — which makes constant-time code simpler.
Ed25519 (RFC 8032 §5.1) signatures are 64 bytes with 32-byte public keys, and they are deterministic: the nonce is derived from the private key and the message, so a weak random number generator cannot leak the key. Ed25519 is used by SSH (ssh-ed25519), TLS 1.3, DNSSEC (algorithm 15), JOSE and COSE (Ed25519, RFC 9864), Solana and Tor onion services, and FIPS 186-5 approves it.
Because the group has cofactor 8, libraries disagree on edge cases — whether verification multiplies by the cofactor and which non-canonical encodings of points they accept — so the same signature can verify in one library and fail in another (Chalkias, Garillot and Nikolaenko, 'Taming the many EdDSAs').