what is the difference between Session and Viewstate

Variables put into Session are stored wherever the configured SessionStateProvider is configured to store them.

The default SessionStateProvideruses what's referred to as In Process (InProc) Session and the storage location for this is in server memory, inside the memory space of the ASP.NET worker process.

You can configure your own SessionStateProvider to store Session variables elsewhere, such as out of process, in a database.