# Crypto-period for keys used in PRF

I am wondering about the crypto-period for keys used in pseudo-random functions.

For example, let's say I am using HMAC-SHA256 with a secret key $K$.

After how many computes do I have to update $K$?

You don't need to change the key at all in terms of it being "overused". The only reason to change a key is when you use it beyond the bounds given in proofs of security. You have to look this up, but if you are using HMAC-SHA256 with a 256-bit key then you can go on for about $2^{128}$ computations, which you will never every do.