A private key is just a randomly chosen 256-bit number (technically, any number from 1 up to just below 2256, the order of the secp256k1 curve). That number is the only thing standing between your bitcoin and everyone else.
How big is 2256?
About 1077 — only a few orders of magnitude below the estimated 1078–1082 atoms in the observable universe. Guessing a properly random key by brute force isn't just hard; it is far beyond any known technology.
From key to address
Using elliptic-curve math (the secp256k1 curve), the private key produces a public key. This is a one-way street: easy to compute forward, infeasible to reverse. The public key is then hashed into an address.
Signing
To spend, your wallet creates a digital signature (ECDSA, or Schnorr since the 2021 Taproot upgrade). Every node can verify that the signature matches the public key, without ever seeing the private key.
Randomness is everything
Keys must come from a good random source. Keys made from simple passphrases ("brain wallets") or bad random generators have been stolen within seconds.
Backups
The seed phrase standard (BIP39) encodes a master secret as words, from which thousands of keys are derived (BIP32). Protect the seed and you protect every key. There is no "forgot password" button — that is the price of self-custody.