With a session, the server keeps the login state itself in a store. It saves the state under a session id, and the client keeps only that id, in a cookie for example.

A token, such as a signed JWT, contains the login state inside itself. A server that can verify the signature can trust the token without asking anyone.

When requests are spread across several servers, a session id works only if every server can reach the same store. A token needs nothing shared except the ability to verify the signature.

Revocation speed differs too. A session stops working as soon as the server deletes its record. A token issued with a long expiry stays valid until it expires, so revoking it needs a separate mechanism on the server side.