The answer is in the name: PBKDF is an acronym standing for "Password-Based Key Derivation Function". Its whole job is to take a password as input and generate an encryption key as output.
The primary reason we need functions like this is that encryption algorithms like AES take a fixed size key. By definition, AES-128 requires a 128 bit (16-byte) key. But a user's password is simply a series of bytes - maybe it's 50 bytes, maybe it's only 5 bytes, depending on what the user entered. Therefore, if you want to use the password to encrypt, you somehow have to embed that password into the exact 16 bytes required by AES. You're obviously doing something like that already in order to feed your current password into AES, even if you don't recognize it by that name.
A PBKDF is designed to take however many bytes the user inputs, stir them all together using an algorithm (called a hash), and then produce a string of bits suitable for use as a key. If you need 16 bytes for your AES key, you simply take the first 16 bytes that come out of the PBKDF function.
Think about if you didn't use a PBKDF, but instead required your users to enter at least a 16 byte password. Without a PBKDF, what happens to everything after the 16th byte? It becomes meaningless. If I type a password of security.stackexchange.com, I could also type a password of security.stackexPOSITION@ORG or just security.stackex and any of them would still work. But because a PBKDF mixes all of those letters together, they all contribute to the key, and the whole password is checked.
The next reason we need PBKDF functions is that passwords have a lot of predictability in them, because English-speaking humans usually only use characters in the ranges of a-z, A-Z, and 0-9. Despite the fact that there are 8 bits in a byte, a 10 character password will not provide 80 bits of uncertainty in the key; most will provide 47 bits (or less) of uncertainty, and that means it can be easily guessed by a modern attacker. But because a PBKDF takes all the letters of the password into account, it makes a 20 character password much stronger than a 10 character password, and improves your users' security.
A stronger routine such as PBKDF2 goes one step farther than a simple PBKDF in helping protect against a password guessing attack, by making the operation take a large amount of computing resources. An attacker who wishes to try guessing every word in the dictionary will need only a few milliseconds to try every word as a decryption key. An attacker who needs to run through 10,000 hashes with PBKDF2 will take hours or days to try the whole dictionary.
