A hardware firewall is a network appliance dedicated strictly to performing the functions of a firewall. They may have hardware built specifically to speed the routing of packets, such as large RAM buffers on the network adapters. And they are running an operating system designed to run a network appliance.
A software firewall is an OS-level application performing firewall-like functions running on an ordinary computer that may also be running other applications. Networking functions are accomplished through software running in the OS.
The idea is that a hardware firewall will be "more secure" than a software firewall because it has a reduced attack surface. With no other applications running on the hardware firewall, there are no additional memory buffers to exploit, no extra protocols with vulnerabilities, no unknown programs, no stray ports left open.
If you take an ordinary PC running a desktop OS and run a software firewall on it, it's still a software firewall. The desktop OS may be running dozens of services that don't perform firewall functions, and they increase your attack surface. You may not even be able to disable some ports on a consumer version of Windows 10, for example. However, if you install an OS intended to be a dedicated networking appliance, such as OpenWRT, and if you run only a firewall on it, you'll have security much closer to a hardware firewall; although you probably won't get the same performance as you might with a commercial firewall appliance.
Keep in mind that having a dedicated firewall is one thing; but having a secure configuration on it is another. The best hardware firewall on the market is useless if you don't change the default password, if you don't set deny all by default, or if you fail to disable UPnP support. This is true regardless of if it's a hardware or software firewall.
Also note that if an attacker passes their attack through a firewall to a web application and manages to violate the web server's integrity, the end result is the same. Firewalls stop traffic on unknown ports; they do nothing for malicious traffic on known ports.