PGP without the jargon

A PGP key is a pair of numbers, one public and one secret. The public one goes on your profile so others can encrypt to you and verify your signatures. The secret one stays with you and is what actually signs a message. A signed message proves it came from the holder of the secret key, which a password alone cannot do.

What it does not do is replace your password. It layers proof on top of it. If someone steals your login they can read your messages, but they cannot forge a signed instruction without also stealing the secret key, which lives on your device. That is the difference between being read and being impersonated.

Generate the pair once, keep the secret half somewhere safe, and put the public half on the account. It is a small step that closes a large gap.