Also called: fingerprint, content hash
In plain words
A fingerprint is a short hash that stands in for a piece of content. The same content always gives the same fingerprint, a one-character change gives a completely different one, and you can't get the content back from the hash. So two parties can prove they're talking about identical text without either of them handing the text over.
How QED Proof uses it
Receipts follow a minimum-data rule: they record what's needed to re-check an outcome and nothing more. Identifiers, timestamps, status codes and fingerprints are allowed. Content bodies, personal data beyond the named target, and credentials are not.
A fingerprint in the receipt spec is sha256: + base64url(SHA-256(normalised content)). Normalised means Unicode NFC, line endings converted to LF, trailing whitespace on each line removed, and leading or trailing blank lines removed. That way an agent's text and the text the destination serves still match after invisible differences like \r\n. A verifier profile may be stricter, and if it is, it must say so.
When the fingerprint the agent claims differs from the one computed at the destination, the verdict is Mismatch with reason content_mismatch.
Example
An agent claims it published a specific caption. The receipt holds the fingerprint of the published caption, not the caption itself, so the receipt can be shared openly and the caption still can't be read from it.