Both are pronouns, and the difference is that who is the subject pronoun whilst whom is the object pronoun. Clear as mud? Okay, let's take this sentence: I love you. You in this sentence are the object of my affection. You is also the object of the sentence. ;) I is the subject and you the object. Therefore, the Rolling Stones displayed incorrect grammar in their song Who Do You Love.
If you refer to the subject, you use who:
Who hexed you?
Who was hiding in the dungeons?
If you refer to the object, you use whom:
"You love whom?" Ron asked incredulously.
Whom did he hide in the dungeons?
And here is a trick: If you can answer that who/whom question with him, which has an m at the end, just like whom, then you use whom. If you answer the question with he, which doesn't contain an m, then you use who.