We are currently using this code block in an email
%%[ VAR @email, @customer_no, @secret, @url, @hash SET @email = "%%email%%" SET @customer_no = "%%customer_no%%" SET @secret = "<secretkey>" SET @hash = SHA256(Concat(@email,@customer_no,@secret)) SET @url = Concat("<CompanyURL>?a=",@email,"&c=",@customer_no,"&h=",@hash) ]%%
And vardumping with
%%=v(@email)=%% %%=v(@customer_no)=%% %%=v(@secret)=%% %%=v(@hash)=%%
The url that we get has both the email address and the customer number correctly, but the hash is wrong. Looking at the vardump, the email and customer_no were returning "%%email%%" and "%%customer_no%%" respectively instead of the personalizations. The hash should be "emailcustomer_nosecret" no spaces between.