Why can hr create an Oracle DB session though not using PWFILE?
Only user having sysdba and sysoper privilege are connected to database using password file authentication. Other users such as HR are authenticated using data dictionary. 

Password file is required for SYSDBA and SYSOPER privileged users to make remote connection. As I said earlier other users are authenticated using data dictionary, password file is not required for them to make remote connection.

The password is stored in encrypted form user undocumented table called USER$.

SQL&gt; select password from user$ where name='HR';

PASSWORD
------------------------------
4FF80DF8D8DBE02E