I gave a talk on this topic a few months ago, so I assembled a list then which could be appreciated by a general mathematical audience. I'll reproduce it here. (Edit: I have added a few more examples to the end of the list, starting at item m, which are meaningful to number theorists but not necessarily to a general audience.)
Let's start with three applications of RH for the Riemann zeta-function only.
a) Sharp estimates on the remainder term in the prime number theorem: $\pi(x) = {\text{Li}}(x) + O(\sqrt{x}\log x)$, where ${\text{Li}}(x)$ is the logarithmic integral (the integral from 2 to $x$ of $1/\log t$).
b) Comparing $\pi(x)$ and ${\text{Li}}(x)$. All the numerical data shows $\pi(x)$ < ${\text{Li}}(x)$, and Gauss thought this was always true, but in 1914 Littlewood used the Riemann hypothesis to show the inequality reverses infinitely often. In 1933, Skewes used RH to show the inequality reverses for some
$x$ below 10^10^10^34. In 1955 Skewes showed without using RH that the inequality reverses for some $x$ below 10^10^10^963. Maybe this was the first example where something was proved first assuming RH and later proved without RH.
c) Gaps between primes. In 1919, Cramer showed RH implies $p_{k+1} - p_k = O(\sqrt{p_k}\log p_k)$, where $p_k$ is the $k$th prime. (A conjecture of Legendre is that there's always a prime between $n^2$ and $(n+1)^2$ -- in fact there should be a lot of them -- and this would imply $p_{k+1} - p_k = O(\sqrt{p_k})$. This is better than Cramer's result, so it lies deeper than a consequence of RH. Cramer also conjectured that the gap is really $O((\log p_k)^2)$.)
Now let's move on to applications involving more zeta and $L$-functions than just the Riemann zeta-function. Note that typically we will need to assume GRH for infinitely many such functions to say anything.
d) Chebyshev's conjecture. In 1853, Chebyshev tabulated the primes
which are $1 \bmod 4$ and $3 \bmod 4$ and noticed there are always at least as many $3 \bmod 4$ primes up to $x$ as $1 \bmod 4$ primes. He conjectured this was always true and also gave an analytic sense in which there are more $3 \bmod 4$ primes:
$$
\lim_{x \rightarrow 1^{-}} \sum_{p \not= 2} (-1)^{(p+1)/2}x^p = \infty.
$$
Here the sum runs over odd primes $p$. In 1917, Hardy-Littlewood and Landau (independently) showed this second conjecture of Chebyshev's is equivalent to
GRH for the $L$-function of the nontrivial character mod 4. (In 1994, Rubinstein and Sarnak used simplicity and linear independence hypotheses on zeros of $L$-functions to say something about Chebyshev's first conjecture, but as the posted question asked only about consequences of RH and GRH, I leave the matter there and move on.)
e) The Goldbach conjecture (1742). The "even" version says all even integers $n \geq 4$ are a sum of 2 primes, while the "odd" version says all odd integers $n \geq 7$ are a sum of 3 primes. For most mathematicians, the Goldbach conjecture is understood to mean the even version, and obviously the even version implies the odd version. The odd version turns out to be a consequence of GRH. In 1923, assuming all Dirichlet $L$-functions are nonzero in a right half-plane ${\text{Re}}(s) \geq 3/4 - \varepsilon$, where $\varepsilon$ is fixed (independent of the $L$-function), Hardy and Littlewood showed the odd Goldbach conjecture is true for all sufficiently large odd $n$. In 1937, Vinogradov proved the same result without needing GRH as a hypothesis. In 1997, Deshouillers, Effinger, te Riele, and Zinoviev showed GRH implies the odd Goldbach conjecture is true for all odd $n \geq 7$. So GRH completely settles the odd Goldbach conjecture.
Update: This is now an obsolete application of GRH since the odd Goldbach Conjecture was proved by Harald Helfgott in 2013 without needing GRH as a hypothesis.
An account of the current status of Helfgott's work is here.
f) Polynomial-time primality tests. By results of Ankeny (1952) and Montgomery (1971), GRH for all Dirichlet $L$-functions implies that the first nonmember of every proper subgroup of the unit group $({\mathbf Z}/m{\mathbf Z})^\times$ is $O((\log m)^2)$, where the $O$-constant is independent of $m$. In 1985, Bach showed GRH for all Dirichlet $L$-functions implies the constant in that $O$-estimate can be taken to be 2. That is, GRH for all Dirichlet $L$-functions implies that each proper subgroup of $({\mathbf Z}/m{\mathbf Z})^\times$ is missing some integer from 1 to $2(\log m)^2$. Put differently, GRH for all Dirichlet $L$-functions implies that if a subgroup of $({\mathbf Z}/m{\mathbf Z})^\times$ contains all positive integers below $2(\log m)^2$ then the subgroup is the whole unit group mod $m$. (To understand one way that GRH has an influence on that upper bound, if all the nontrivial zeros of all Dirichlet $L$-functions have ${\text{Re}}(s) \leq 1 - \varepsilon$ then the first nonmember of every proper subgroup of $({\mathbf Z}/m{\mathbf Z})^\times$ is $O((\log m)^{1/\varepsilon})$. Set $\varepsilon = 1/2$ to get the previous result I stated that uses GRH.) In 1976, Gary Miller introduced a deterministic primality test that he could prove runs in polynomial time using GRH for all Dirichlet $L$-functions. (Part of the test involves deciding if a subgroup of units mod $m$ is proper or not.) Shortly afterwards, Solovay and Strassen described a different primality test using Jacobi symbols. GRH for Dirichlet $L$-functions implies their test runs in polyomial time, and the subgroups of units mod $m$ occurring for their test contain $-1$, so the proof that their test runs in polynomial time "only" needs GRH for Dirichlet $L$-functions of even characters. (Solovay and Strassen described their test as a probabilistic test rather than a deterministic test, so they didn't mention GRH one way or the other.)
In 2002 Agrawal, Kayal, and Saxena created a new primality test that they could prove runs in polynomial time without needing GRH. This is a nice example showing how GRH guides mathematicians in the direction of what should be true and then people tried to find a proof of those results by methods not involving GRH.
g) Euclidean rings of integers. In 1973, Weinberger showed that GRH for all Dedekind zeta-functions implies that every ring of algebraic integers with an infinite unit group (so ignoring $\mathbf Z$ and the ring of integers of imaginary quadratic fields) is Euclidean if it has class number 1. As a special case, in concrete terms, if $d$ is a positive integer that is not a perfect square then a ring ${\mathbf Z}[\sqrt{d}]$ that is a unique factorization domain must be Euclidean. The same theorem is true for rings of $S$-integers: an infinite unit group plus class number $1$ plus GRH for zeta-functions of all number fields implies the ring is Euclidean. Progress has been made by Ram Murty and others in the direction of proving class number 1 and infinite unit group implies Euclidean for rings of $S$-integers without needing GRH, and as a striking special case let's consider ${\mathbf Z}[\sqrt{14}]$. It has class number 1 (which must have been known to Gauss in the early 19th century, in the language of quadratic forms) and an infinite unit group, so it should be Euclidean. This particular real quadratic ring was first proved to be Euclidean only in 2004 (by M. Harper). So $\mathbf Z[\sqrt{14}]$ is a ring that was known to have unique factorization for over 100 years before it was proved to be Euclidean.
h) Artin's primitive root conjecture. In 1927, Artin conjectured that each nonzero integer $a$ that is not $-1$ or a perfect square is a generator of $({\mathbf Z}/p{\mathbf Z})^\times$ for infinitely many primes $p$, and in fact for a positive proportion of such $p$.
As a special case, taking $a = 10$, this says for primes $p$ the unit fraction $1/p$ has decimal period $p-1$ for a positive proportion of $p$. (For each prime $p$ other than $2$ and $5$, the decimal period for $1/p$ is a factor of $p-1$, so this special case is saying the largest possible period is realized infinitely often in a precise sense.) In 1967, Hooley showed GRH for zeta-functions of number fields implies Artin's primitive root conjecture. More precisely, Artin's primitive root conjecture for $a$ follows from GRH for the zeta-functions of all the number fields $\mathbf Q(\sqrt[n]{a},\zeta_n)$ where $n$ runs over the squarefree positive integers. In 1984, R. Murty and Gupta showed Artin's primitive root conjecture is true for infinitely many $a$ without having to use GRH, but their proof couldn't pin down even one specific $a$ for which Artin's primitive root conjecture is true. In 1986, Heath-Brown showed without using GRH that Artin's primitive root conjecture is true for all prime values of $a$ with at most two exceptions (and of course there should not be any exceptions). Without using GRH, no definite $a$ is known for which Artin's conjecture is true.
i) First prime in an arithmetic progression. If $\gcd(a,m) = 1$ then there are infinitely many primes $p \equiv a \bmod m$. When does the first one appear, as a function of $m$? In 1934, Chowla showed GRH implies the first prime $p \equiv a \bmod m$ is $O(m^2(\log m)^2)$. In 1944, Linnik showed without GRH that the bound is $O(m^L)$ for some universal exponent $L$. The latest choice for $L$ (Xylouris, 2009) without using GRH is $L = 5.2$.
j) Gauss' class number problem. Gauss (1801) conjectured in the language of quadratic forms that there are only finitely many imaginary quadratic fields with class number 1. (He actually conjectured more precisely that the 9 known examples are the only ones, but for what I want to say the weaker finiteness statement is simpler.) In 1913, Gronwall showed this is true if the $L$-functions of all imaginary quadratic Dirichlet characters have no zeros in some common strip $1- \varepsilon < {\text{Re}}(s) < 1$. That is weaker than GRH (we only care about $L$-functions of a restricted collection of characters), but it is a condition like GRH for infinitely many $L$-functions. In 1933, Deuring and Mordell showed Gauss' conjecture is true if the ordinary RH (for the Riemann zeta-function) is false, and then in 1934 Heilbronn showed Gauss' conjecture is true if GRH is false for some Dirichlet $L$-function of an imaginary quadratic character. Since Gronwall proved Gauss' conjecture is true when GRH is true for the Riemann zeta-function and the Dirichlet $L$-functions of all imaginary quadratic Dirichlet characters and Deuring--Mordell--Heilbronn proved Gauss' conjecture is true when GRH is false for at least one of those functions, Gauss' conjecture is true by baby logic. In 1935, Siegel proved Gauss' conjecture is true without using GRH, and in the 1950s and 1960s Baker, Heegner, and Stark gave separate proofs of Gauss' precise "only 9" conjecture without using GRH.
k) Missing values of a quadratic form. Lagrange (1772) showed every positive integer is a sum of four squares. However, not every integer is a sum of three squares: $x^2 + y^2 + z^2$ misses all $n \equiv 7 \bmod 8$. Legendre (1798) showed a positive integer is a sum of three squares iff it is not of the form $4^a(8k+7)$. This can be phrased as a local-global problem: $x^2 + y^2 + z^2 = n$ is solvable in integers iff the congruence $x^2 + y^2 + z^2 \equiv n \bmod m$ is solvable for all $m$. More generally, the same local-global
phenomenon applies to the three-variable quadratic form $x^2 + y^2 + cz^2$ for all integers $c$ from 2 to 10 except $c = 7$ and $c = 10$. What happens for these two special values? Ramanujan looked at $c = 10$. He found 16 values of $n$ for which there is local solvability (that is, we can solve $x^2 + y^2 + 10z^2 \equiv n \bmod m$ for all $m$) but not global solvability (no integral solution for $x^2 + y^2 + 10z^2 = n$). Two additional values of $n$ were found later, and in 1990 Duke and Schulze-Pillot showed that local solvability implies global solvability except for (ineffectively) finitely many positive integers $n$. In 1997, Ono and Soundararajan showed GRH implies the 18 known exceptions are the only ones.
l) Euler's convenient numbers. Euler called an integer $n \geq 1$ convenient if each odd integer greater than 1 that has a unique representation as $x^2 + ny^2$ in positive integers $x$ and $y$, and which moreover has $(x,ny) = 1$, is a prime number. (These numbers were convenient for Euler to use to prove certain numbers that were large in his day, like $67579 = 229^2 + 2\cdot 87^2$, are prime.) Euler found 65 convenient numbers below 10000 (the last one being 1848). In 1934, Chowla showed there are finitely many convenient numbers. In 1973, Weinberger showed there is at most one convenient number not in Euler's list, and that GRH for $L$-functions of all quadratic Dirichlet characters implies that Euler's list of convenient numbers is complete. What he needed from GRH is the lack of real zeros in the interval $(53/54,1)$.
m) Removing a condition in the Brauer-Siegel theorem. In 1947, Brauer proved the Brauer-Siegel theorem for sequences of number fields $K_n$ such that (i) $[K_n:\mathbf Q]/\log |{\rm disc}(K_n)| \to 0$ as $|{\rm disc}(K_n)| \to \infty$ and (ii) $K_n$ is Galois over $\mathbf Q$. If the zeta-functions $\zeta_{K_n}(s)$ all satisfy GRH (what is actually needed is no real zero in $(1/2,1)$ for those zeta-functions) then we can drop condition (ii). That is, GRH implies the Brauer-Siegel theorem holds for sequences of number fields $K_n$ fitting condition (i).
n) Lower bounds on root discriminants. In 1975, Odlyzko showed GRH for zeta-functions of number fields implies a lower bound on root discriminants of number fields:
$$
|{\rm disc}(K)|^{1/n} \geq (94.69...)^{r_1/n}(28.76...)^{2r_2/n} + o(1)
$$
as $n = [K:\mathbf Q] \to \infty$. (The lower bound was improved later to $136^{r_1/n}34.5^{2r_2/n}$ for sufficiently large $n$.) Building on ideas of Stark, he also showed that GRH for zeta-functions of number fields implies there are only finitely many CM number fields with a given class number (a big generalization of the known fact that only finitely many imaginary quadratic fields have any particular class number).
o) Lower bounds on class numbers. In 1990, Louboutin showed GRH for zeta-functions of imaginary quadratic fields (what is really needed is the lack of real zeros in $(1/2,1)$ for these zeta-functions) implies the lower bound $h(\mathbf Q(\sqrt{-d})) \geq (\pi/(3e))\sqrt{d}/\log d$ for imaginary quadratic fields with discirminant $-d$. The point here is the explicit constant factor $\pi/(3e)$. (Hecke had shown such a lower bound with a "computable constant" $c$ in place of $\pi/(3e)$ but he did not compute the constant.) Without GRH, lower bounds for $h(\mathbf Q(\sqrt{-d}))$ are on the order of $\log d$, which is far smaller than $\sqrt{d}/\log d$. For example, Louboutin's GRH-based lower bound shows if $h(\mathbf Q(\sqrt{-d})) \leq 100$ then $d \leq $ 18,916,898. To put this 8-digit upper bound in perspective,
when Watkins determined all imaginary quadratic fields with class number up to 100 in 2004, he used lower bounds on $h(\mathbf Q(\sqrt{-d}))$ that do not depend on GRH and the upper bound of his search space for $d$ was $e^{298368000}$, a number with 129,579,576 digits. Just the exponent in that upper bound on $d$ is greater than the upper bound on $d$ coming from GRH.
p) Proof of André-Oort conjecture. In 2014, Klingler and Yafaev showed GRH for zeta-functions of CM number fields implies the André-Oort conjecture. Daw and Orr gave another proof also using the same version of GRH.
Update: This is now an obsolete application of GRH since the André-Oort conjecture has been proved without GRH. See here.
q) Class number calculations. In 2015, J. C. Miller showed that GRH implies the class number $h_p^+$ of the real cyclotomic field $\mathbf Q(\zeta_p)^{+}$ for prime $p$ is $1$ for all $p$ from 157 to 241 except $h_{163}^+ = 4$, $h_{191}^{+} = 11$, and $h_{229}^+ = 3$.
r) Elliptic curve rank values. In 2019, Klagsbrun, Sherman, and Weigandt used GRH for $L$-functions of elliptic curves and for zeta-functions of number fields to prove that the elliptic curve found by Elkies in 2006 with 28 independent rational points has rank equal to 28.
Best Answer
As a strengthening of what @KConrad commented, it would imply that the density of nontrivial zeros on the critical line is 100% in each horizontal strip of height 1, which is not useless: this is equivalent to the Lindelöf Hypothesis, which states that $\zeta \left( \frac{1}{2} + i t \right) = \mathcal{O}_{\varepsilon} \left( 1 + \lvert t \rvert^{\varepsilon} \right)$.
One example of a consequence of the Lindelöf Hypothesis (which is exactly much easier to prove directly from your non-effective Riemann Hypothesis using the explicit formula) is that the prime gaps satisfy $p_{n + 1} - p_n \leq \sqrt{p_n} \log \left( p_n \right)^2$, improving the best current unconditional result by Baker-Harman-Pintz of $p_{n}^{0.525}$.
The exponent of the logarithm might be a bit less, but I decided to err on the side of caution. By the way, this is still very far from the conjectured upper bound $p_{n}^{\varepsilon}$ (and in fact it is relatively widely believed that the gap is at most $C \log \left( p_n \right)^2$ for some absolute constant $C$).
However, the Lindelöf Hypothesis appears in estimating arithmetic sums, as many counting problems can be transformed into a zeta integral. Let me illustrate by a simple example. We will prove (conditionally) the following: $$\sum_{n = 1}^{N} d (n) = n \log n + (2 \gamma - 1) n + \mathcal{O}_{\varepsilon} \left( n^{1/2 + \varepsilon} \right)$$ where $d(n)$ is the number of divisors of $n$ and $\gamma$ is the Euler-Mascheroni constant. This is usually proved via the Dirichlet hyperbola method (and with good reason), and we get a slightly weaker error term than usual, but this is just to illustrate the technique. Recall the classical inverse Mellin transform $$\intop_{c - i \infty}^{c + i \infty} x^s \frac{\mathrm{d} s}{s} = 1_{x > 1} + \frac{1}{2} 1_{x = 1}$$ for any $c > 0, \ x \in \mathbb{R}$. Taking $c > 1$, and interchanging summation and integration we get (up to an error of $\frac{d (n)}{2}$, which is negligible) $$\sum_{n = 1}^{N} d(n) = \intop_{c - i \infty}^{c + i \infty} \sum_{n = 1}^{\infty} d(n) \left( \frac{N}{n} \right)^{s} \frac{\mathrm{d} s}{s} = \intop_{c - i \infty}^{c + i \infty} \zeta \left( s \right)^2 \frac{N^s \mathrm{d} s}{s}$$
Now, shift the contour to $\mathrm{Re(s) = \frac{1}{2}}$. The residue picked up at the pole $s = 1$ is exactly $N \log N + (2 \gamma - 1) N$, so all we have left to proveis to show that the expression $$N^{\frac{1}{2}} \intop_{-\infty}^{\infty} \zeta \left( \frac{1}{2} + i t \right)^2 N^{i t} \frac{\mathrm{d} t}{\frac{1}{2} + i t}$$ is $\mathcal{O}_{\varepsilon} \left( N^{1/2 + \varepsilon} \right)$, or equivalently that the integral is $\mathcal{O}_{\varepsilon} \left( N^{\varepsilon} \right)$.
Here is the point where I tell you that I actually lied beforehand: it turns out that using the full inverse Mellin transform is, although very elegant, not necessarily the best choice to get a good analytic bound. What is usually done is approximate it by integrating not from $c - i \infty$ to $c + i \infty$, but from $c - i N$ to $c + i N$, where $c$ is say something like $1 + \frac{1}{\log N}$. I don't remember the details off the top of my head (they appear for example in Montgomery's book, and in a few expositions of proofs of the Prime Number Theorem), so just trust me here when I say that it is sufficient to bound the integral $$\intop_{- N}^{N} \zeta \left( \frac{1}{2} + i t \right)^{2} N^{i t} \frac{\mathrm{d} t}{\frac{1}{2} + i t}$$ But now (and here we finally use the Lindelöf Hypothesis!) we can bound pointwise this integral, and get that it is $\mathcal{O}_{\varepsilon} \left( N^{\varepsilon} \right)$ as required.
This example, although somewhat stupid, shows the power of the Lindelöf Hypothesis. Indeed, see Tao's answer The relationship between the Dirichlet Hyperbola Method, the prime counting function, and Mertens function, where he points out the fundamental difference between arithmetic functions with zeta in their denominator (whose behaviour is controlled very much by the zeroes of zeta) and arithmetic functions with zeta in the numerator. Despite that, we still managed to use information about the zeroes of zeta to get a nontrivial estimate.