Cryptographic keys are usually fixed-length values. Unfortunately, humans can't remember long strings of numbers, so we use passwords instead.
For example, this might be your 256-bit key:
Not too easy to remember, is it?
However, the above was generated by computing a cryptographic hash (in this case SHA256) of the word "waffles", which is much easier to remember. A hash function takes an arbitrary length input, and computes a fixed length output.
In reality, we need key-derivation functions (KDFs) to have special properties. One desirable property is that it should be computationally infeasible to compute
h = KDF(m), i.e. it's difficult to compute the input of the function if you only know the output. Another desirable property is that the function is computationally expensive (slow) enough to make computing millions of keys infeasible, without degrading performance for legitimate uses. As such, special KDF schemes such as PBKDF2 and bcrypt are usually used to compute these cryptographic keys from easily remembered passwords.
The only practical way to break a key generated by an ideal strong key-derivation function is to guess likely passwords. If your password is "password", it's likely to be broken. If you password is a string of 20 random letters and numbers, it's much less likely to be guessed.
To address the question you ask at the end:
If the password is "pass", what's the resulting key?
This isn't really a question that makes much sense. The result could be anything. There are lots of different hash functions (MD5, SHA1, SHA256, SHA512, Whirlpool, RIPEMD160, etc) and many different key-derivation functions (PBKDF2, bcrypt, scrypt), which can use salts or HMAC. The possibilities are endless!