Key generation hashes a 32-byte seed with SHA-512: the first half, clamped, is the secret scalar and the second half is the nonce prefix. The public key is the 32-byte little-endian encoding of a point's y-coordinate with the sign of x in the top bit, and a signature is R ‖ S, 64 bytes. APIs disagree on what "private key" means: the 32-byte seed (RFC 8032, PKCS #8 per RFC 8410) or 64 bytes of seed followed by public key (NaCl, libsodium, Go's ed25519.PrivateKey), a frequent source of conversion bugs.
Identifiers: OID 1.3.101.112 with absent algorithm parameters (RFC 8410); JOSE kty OKP, crv Ed25519 (RFC 8037) and alg Ed25519 (RFC 9864, replacing the polymorphic EdDSA); COSE −19 (and the older −8); TLS 1.3 ed25519 (0x0807); SSH ssh-ed25519 (RFC 8709); native OpenPGP v6 keys (RFC 9580). WebCrypto supports it in Firefox 129, Safari 17 and Chrome 137 and later.
On one core of an Apple M4 Max, OpenSSL 3.6.5 makes about 59,800 Ed25519 signatures and 24,900 verifications per second. FIPS 186-5 approves Ed25519. Libraries differ on adversarial edge cases (small-order points, non-canonical encodings, cofactored versus cofactorless checks), which matters only where many parties must agree on validity.
Compared with ECDSA it needs no signing-time randomness, has no high-S variant and uses complete addition formulas. Its main gap is hardware: Apple's Secure Enclave and many smart cards and HSMs offer only P-256, which is why passkeys and device-bound keys are mostly ECDSA.