A trapdoor function is a lock with a hidden back door: anyone can compute it, nobody can run it backwards, except whoever holds a secret, who gets the whole input back.
The idea: RSA turns a number x into x^e mod N, which anyone can compute from the public key. Running it backwards is believed hard, unless you know d, which is easy to compute from the two primes behind N. With d you recover x itself, not just a message hidden inside it: that full recovery is what makes it a trapdoor function.
Public-key encryption asks for less: the message must come back, but the randomness used to encrypt it may stay hidden, as in ElGamal. That's why public-key encryption could exist even if trapdoor functions didn't.
Why it matters: It's the oldest route to public-key cryptography (RSA) and the engine of hash-and-sign and blind signatures. It's a slightly stronger bet than public-key encryption itself, yet implied by nearly every public-key assumption in use.
On the map: a secret lets you recover the whole input (RSA, lattice trapdoors). Gives public-key encryption. The converse fails in a black-box way, and ElGamal is not one. If impossible, every TD-tagged assumption falls
A trapdoor function is easy to compute from a public key, hard to invert, and easy to invert for whoever holds the matching secret, who gets the whole input back. RSA is the classic example: anyone computes x^e mod N, and the holder of d recovers x exactly. Lattices have trapdoors too: a short secret basis lets its holder solve problems that look random to everyone else[1].
A trapdoor function gives public-key encryption: send f(r) for a random r, and use a hard-core bit of r, one as hard to predict as inverting f, as a one-time pad for the message[2, 3]. The converse fails, at least in any black-box way: Gertner, Malkin and Reingold showed trapdoor functions can't be built that way from public-key encryption[4], and Rudich gave an oracle world with key agreement in three messages but no trapdoor functions at all[5]. So the arrow runs one way: if public-key encryption is impossible, trapdoor functions are too, not the reverse.
ElGamal shows the gap. It encrypts m as (g^r, m·h^r) with a fresh random r. The key holder gets m back but not r, which would be a discrete log even for them[6]. It is public-key encryption without being a trapdoor function. For the assumptions in use the gap closes: RSA and Rabin are trapdoor permutations directly, lattices have trapdoors, and Peikert and Waters built trapdoor functions from DDH and from LWE, the assumptions behind ElGamal and Regev's encryption[7]. The difference is between the abstract notions.
So if trapdoor functions didn't exist, every assumption tagged TD would fall: factoring (the Rabin function is a trapdoor permutation exactly as hard as factoring[8]), the RSA problem[9], composite residuosity[10], computational Diffie-Hellman[11] and decisional Diffie-Hellman[7] (and with them the pairing assumptions), LWE and its ring and module versions[1, 12], NTRU[13] and the knapsack trapdoor[14]. Code-based and isogeny assumptions are untagged: no trapdoor function from them alone is established.
What trapdoors are used for: hash-and-sign signatures, where signing is inverting the function on the message's hash (RSA signatures, and Falcon through the lattice framework above[1]). They also give blind signatures, behind privacy-preserving tokens[15], the classic oblivious transfer protocol and through it secure computation[16], non-interactive zero-knowledge proofs for any NP statement[17], encryption secure against chosen ciphertexts, and identity-based encryption from lattices[7, 1].
If any of these breaks, this breaks too.
If this breaks, these break with it.