Disavow
Disavowing is telling Google to ignore specific backlinks or domains when assessing your site, via a file uploaded in the disavow tool.
Updated , every quotation and figure read in its source that day.
To disavow links is to ask Google to ignore specific pages or domains that link to your site, by uploading a text file in Search Console's disavow links tool. It exists for one situation, unnatural links that have caused or will cause a manual action, and Google warns that misusing it can hurt you.
When Google says you need it
Google's help page starts with a step 0, "Decide if this is necessary": "In most cases, Google can assess which links to trust without additional guidance, so most sites will not need to use this tool." It sets two conditions, both required: "You have a considerable number of spammy, artificial, or low-quality links pointing to your site, AND The links have caused a manual action, or likely will cause a manual action, on your site." Before disavowing, Google asks you to try to get the links removed (Disavow links to your site, Search Console Help).
It also calls the tool "an advanced feature" that "should only be used with caution", because used incorrectly it "can potentially harm your site's performance in Google Search results".
The file: format and limits
The file is plain text (UTF-8 or 7-bit ASCII) ending in .txt, with one URL or one domain:example.com line per entry; lines starting with # are comments. URLs can be up to 2,048 characters, and the file up to 100,000 lines and 2MB. You cannot disavow a subpath such as example.com/en/ (Google).
Each property has one list, and uploading a new one replaces it, so edit the current file rather than starting over. The tool does not support Domain properties. After a successful upload, Google says it "can take a few weeks" to take the list into account as it recrawls.
"Toxic" backlinks
"Toxic backlink" is a term from SEO tools, not from Google. Tools score links with their own models: Moz's Spam Score, for instance, is the share of sites with similar features that Moz found penalized or banned, and Moz says a high score "doesn't mean this site is necessarily spammy" (Moz). Google's own position is that since 2016 Penguin "devalues spam by adjusting ranking based on spam signals, rather than affecting ranking of the whole site" (Google, 2016). A high tool score is a reason to look at a link, not a reason to disavow it.
Negative SEO
Negative SEO means a third party pointing spammy links at your site to hurt it. Google's help page addresses it in one line: "Google works very hard to make sure that actions on third-party sites do not negatively affect a website" (Google). If an attack is followed by a manual action for unnatural links, the disavow tool is the remedy Google provides; without one, it is usually not needed.
How to do it
Export your links from the Links report in Search Console, keep only the pages or domains you can justify, write the file in the format above, and upload it for the right property in the disavow links tool. Disavowed links keep showing in the Links report. The decision process, and the cases where doing nothing is safer, are in how to remove bad backlinks.