Good layperson analogy for password and encryption keys
A cryptographic key is a string of bits. For example, AES-128 uses 128 bits, each one of them being either 0 or 1. To be able to encrypt or decrypt, each one of those 128 bits must be set correctly. This key is the input to the encryption algorithm. For AES-128 it has to be exactly 128 bits - not more nor less.
For humans, remembering 128 bits (= 16 bytes) is very difficult and impractical. It's much easier to remember (and type) a passphrase such as &quot;mary had a little lamb&quot; than an AES-128 key such as 0a fc 5d e7 43 21 9c b3 6f 1b 93 c7 70 55 24 18. Furthermore, a requirement that all passwords must be exactly 16 bytes is silly. For AES-256 you woud need twice as much. And of course, the true entropy of a 16-character password is much less than 128 bits because of language redundancy and the fact that an ASCII character takes up only 7 bits.
This is why we have key derivation functions (KDF). You input a password of any length into a KDF and tell it how many bits you need for key. The KDF takes the bits from the password, adds some magic spices (called salt) and mixes them up using some cryptographic hash function. You get out just as many bits as you wanted which have the same statistical properties as if they were random. They are based on password, so the same password will always give you the same key. As such, KDF are a perfect &quot;converter&quot; of passwords into cryptographic keys.
If an adversary wants to break the encryption, he/she ultimately needs the encrption key (e.g. 128 bits for AES-128). With a truly random key, this means trying 2^128 combinations, which is an awful lot. Because passwords have less entropy, it would make more sense to attack the passwords as this would reduce the needed effort by several orders of magnitude. However, good key derivation functions such as PBKDF2 are designed to counter this by requiring to do a long computation (basically applying the hash function 10000 times). This &quot;computational cost&quot; slows down the attack on passwords significantly and makes it unfeasible.
As an analogy:

Cryptographic key is a key that actually opens the door.
Password is the secret word that you tell to the locksmith (KDF) so that he can make a key for you. If you tell the same password to the locksmith, you get the same key.