The invention provides a key updating method and device, and relates to the field of information security. The method comprises the steps that a terminal obtains operation process data through operation request data, encrypts the operation process data through a working key, generates online request data and sends the online request data to a server, receives authorization response data sent by the server, obtains a first working key in the authorization response data, and loads the first working key into a key container to update the working key. According to the method, the working key can be obtained through sign-in; in addition, a new working secret key issued by the server can be received in the terminal operation process to update the existing secret key in the secret key container,operation data needing to be transmitted are encrypted through the updated secret key, the safety of sensitive data in the operation process is ensured, and therefore the safety of the whole operationprocess is improved.