One small correction: SG’s definition of draft is correct, but private is actually different. Private is a post like a personal journal entry that is not meant to be published, and is only viewable by the author on their post/edit page. It’s a way to hide an old entry you don’t want around anymore, but might still want to keep, or whatever.
Password protected posts are completely seperate, and are in the latest beta (0.72-beta-2). When a post is published and has something in the password protected field, instead of displaying directly a form is displayed. The site visitor can enter a password in that form and if that password matches the post password than the post is displayed. To remove password protection from a post just edit the post and delete the password. Easy peasy.