What's the difference between PBKDF2 and HMAC-SHA256 in security? Being a software developer, I haven't dealt with crypto so far. So I know very little, sorry for that already.

I am aware that you should use bcrypt, scrypt, Argon2 or PBKDF2 for generating a hash from a password. However, I have a question about PBKDF2.

DK = PBKDF2(PRF, Password, Salt, c, dkLen)


PBKDF2 uses a pseudorandom function, for example HMAC-SHA256.

What I understand is that PBKDF2 uses HMAC-SHA256 for c iterations. Why not just use HMAC-SHA256 directly?

I know that you should not use SHA256 for passwords because it's basically "too efficient". So, is HMAC-SHA256 way less efficient, and if so why cannot we use it direclty?

Why does PBKDF2 need a PRF?

Perhaps you can explain it so that even I, who has not much to do with crypto stuff, can understand it. ;-)
HMAC is still very efficient. It's used in PBKDF2 not for the lower efficiency (that's handled by iterating it many times) because of the fact that it takes two inputs. That lets the password and other data be combined in a safe manner, invlunerable to some of the issues that just using SHA256 alone could create. 

PBKDF2 isn't doing H(H(H(...H(Pwd + salt))...), it's doing HMAC(Pwd, HMAC(Pwd, ... HMAC(Pwd, Salt + number)...), where + denotes concatenation and the number is a block index. So the iterations use the password as the key for the HMAC in each stage, and stages other than the first are HMACing the output of the previous stage. This mixes the password in to every iteration of the result, instead of just the first iteration.

Hopefully that explains both why HMAC alone isn't enough and the obvious follow-up question of why HMAC instead of just SHA-256.