Password file is only used to authenticate for SYSDBA,SYSOPER and SYSASM. Not for the normal user.
password file location: $ORACLE_HOME/dbs/orapw$ORACLE_SID
Before the Oracle 10g, if no password file exist, the create database would fail. After the 10g, the cerate database would work but no user can login from remote as SYSDBA,SYSOPER and SYSASM.
orapwd file=$ORACLE_HOME/dbs/orapwMYDB password=orcl
after the password file is created and REMOTE_LOGIN_PASSWORDFILE set to EXCLUSIVE or SHARE, we can login remotely as sysdba.