We are currently using this code block in an email
%%[
VAR @email, @customer_no, @secret, @url, @hash
SET @email = "%%email%%"
SET @customer_no = "%%customer_no%%"
SET @secret = "<secretkey>"
SET @hash = SHA256(Concat(@email,@customer_no,@secret))
SET @url = Concat("<CompanyURL>?a=",@email,"&c=",@customer_no,"&h=",@hash)
]%%
And vardumping with
%%=v(@email)=%%
%%=v(@customer_no)=%%
%%=v(@secret)=%%
%%=v(@hash)=%%
The url that we get has both the email address and the customer number correctly, but the hash is wrong. Looking at the vardump, the email and customer_no were returning "%%email%%" and "%%customer_no%%" respectively instead of the personalizations. The hash should be "emailcustomer_nosecret" no spaces between.