Defined in NIST SP 800-186 §3.2.1.5 and SEC 2 §2.6.1. Identifiers: OID 1.3.132.0.35, TLS group secp521r1 (25), TLS 1.3 ecdsa_secp521r1_sha512 (0x0603), JOSE crv P-521 with alg ES512, COSE −36. The Mersenne prime makes field reduction cheap, but the 521-bit size makes everything else slower: about 7,450 signatures and 4,180 verifications per second on one Apple M4 Max core with OpenSSL 3.6.5.
Sizes trip up code written for "512-bit" assumptions: the private scalar is 66 bytes (521 bits), the public key 133 bytes uncompressed or 67 compressed, a raw JWS ES512 signature exactly 132 bytes (r and s each padded to 66), and DER signatures about 137–139 bytes. Truncating coordinates to 64 bytes or dropping leading zero bytes produces keys and signatures that other libraries reject.
P-521 offers more classical margin than any realistic attacker needs before quantum computers matter, so it is usually chosen for policy reasons rather than security engineering. Like every elliptic curve it falls to Shor's algorithm, and NIST IR 8547 (draft) treats it the same as P-256.