P-256 is the short-Weierstrass curve y² = x³ − 3x + b over the prime p = 2²⁵⁶ − 2²²⁴ + 2¹⁹² + 2⁹⁶ − 1, with a prime group order (cofactor 1). It is specified in NIST SP 800-186 §3.2.1.3 and in SEC 2 as secp256r1; OpenSSL calls it prime256v1, its OID is 1.2.840.10045.3.1.7, TLS names it secp256r1 (group 23) and JOSE/COSE use "crv": "P-256".
Sizes: 32-byte private keys; public keys of 65 bytes uncompressed (04‖x‖y) or 33 bytes compressed; ECDSA signatures of 64 bytes as raw r‖s (JWS ES256) or 70–72 bytes in DER (X.509, TLS, WebAuthn assertions, OpenSSL and Java defaults). Mixing the two encodings is the most common cause of “invalid signature” with valid keys.
It is the default almost everywhere: ES256 JWTs, passkeys (COSE algorithm −7), ECDSA TLS certificates and key shares, Apple's Secure Enclave and most HSMs and smart cards, which often support no other curve. On one core of an Apple M4 Max, OpenSSL 3.6.5 produces about 87,000 P-256 ECDSA signatures and verifies about 29,000 per second.
Its coefficients came from an unexplained NSA seed, which is one reason some designers prefer Curve25519; no weakness in P-256 itself is known. Like every elliptic curve it falls to a large quantum computer, and NIST IR 8547 (draft) proposes disallowing ECDSA and ECDH at all strengths after 2035. For the Bitcoin curve, see P-256 vs secp256k1.