Good layperson analogy for password and encryption keys NOTE: QUESTION UPDATED. SEE BOTTOM OF THIS POST.
I'm writing something where I need to make someone come across as though they know cryptography. I don't know enough, but as cryptography plays only a very minor role in what I'm writing, there's very little I need to know.
As I understand it, a password is a (preferably) mnemonic string that is fed into a function that generates a much longer and complex string that nobody knows, the user included. The encryption key is what is actually used to encrypt and decrypt a file.
Again, as I understand it, if you want to break an encrypted file, you can either try to brute-force the password, or the encryption key (there may well be other ways I'm not aware of). I learned this many years ago when I had forgotten my password to a document and the recovery tool I used claimed that it wouldn't try to crack the password, but rather the encryption key (it did work, in case you're wondering). I don't know where I picked this up from, but for years I was convinced that brute-forcing the encryption key is a better option to crack an encrypted file than going after its password. Possibly, the very software I used claimed it.
Years later, I realised I'm actually not sure if it's true. Is it actually generally faster/more efficient to brute-force the encryption key rather than the password itself? Considering the definition of the password and encryption key I gave above, you'd think the opposite is true.
Also, would you say that, if brute-forcing a password is like trying a bagillion keys to see which one opens a door, finding the encryption key of a file is like removing the lock from the door? I'm looking for a good analogy but I'm not sure this one works at all—especially because doors are rarely scrambled when they're locked...
UPDATE
After reading Gilles 'SO- stop being evil' answer below, I realised I didn't ask the right question. The right question is here. Probably more about information security than cryptography per se.
A cryptographic key is a string of bits. For example, AES-128 uses 128 bits, each one of them being either 0 or 1. To be able to encrypt or decrypt, each one of those 128 bits must be set correctly. This key is the input to the encryption algorithm. For AES-128 it has to be exactly 128 bits - not more nor less.
For humans, remembering 128 bits (= 16 bytes) is very difficult and impractical. It's much easier to remember (and type) a passphrase such as &quot;mary had a little lamb&quot; than an AES-128 key such as 0a fc 5d e7 43 21 9c b3 6f 1b 93 c7 70 55 24 18. Furthermore, a requirement that all passwords must be exactly 16 bytes is silly. For AES-256 you woud need twice as much. And of course, the true entropy of a 16-character password is much less than 128 bits because of language redundancy and the fact that an ASCII character takes up only 7 bits.
This is why we have key derivation functions (KDF). You input a password of any length into a KDF and tell it how many bits you need for key. The KDF takes the bits from the password, adds some magic spices (called salt) and mixes them up using some cryptographic hash function. You get out just as many bits as you wanted which have the same statistical properties as if they were random. They are based on password, so the same password will always give you the same key. As such, KDF are a perfect &quot;converter&quot; of passwords into cryptographic keys.
If an adversary wants to break the encryption, he/she ultimately needs the encrption key (e.g. 128 bits for AES-128). With a truly random key, this means trying 2^128 combinations, which is an awful lot. Because passwords have less entropy, it would make more sense to attack the passwords as this would reduce the needed effort by several orders of magnitude. However, good key derivation functions such as PBKDF2 are designed to counter this by requiring to do a long computation (basically applying the hash function 10000 times). This &quot;computational cost&quot; slows down the attack on passwords significantly and makes it unfeasible.
As an analogy:

Cryptographic key is a key that actually opens the door.
Password is the secret word that you tell to the locksmith (KDF) so that he can make a key for you. If you tell the same password to the locksmith, you get the same key.