 If a password "is" used as an encryption key, then in a well-designed crypto system it would not be used as such on its own.This is because passwords tend to be human-readable and, hence, may not be particularly strong.To compensate, a good crypto system will use the "password-acting-as-key" not to perform the primary encryption task itself, but rather to act as an input to a key derivation function (KDF).