which
where does this command livewhich searches the directories in PATH, in order, and prints the first program that matches the name — the one the shell would run. It answers "is it installed, and which copy am I getting?"
When two versions are installed, which tells you the one you are actually running.
At the terminal
Read the session first, then the notes: each numbered line in the output is answered by the note with the same number.
What the numbered lines are telling you
Typing python3 runs this file. It was found first because /usr/local/bin comes before /usr/bin in PATH.
Two copies are installed. The system’s own is second, and is only reached by typing its full path.
cd is not a program on disk — it is built into the shell — so which finds nothing and prints nothing.
type is part of the shell, so it also reports builtins, aliases and functions. Prefer it when which comes back empty.
Switches
A switch changes how the command behaves. These are the ones used day to day; man which lists the rest. Single-letter switches can usually be joined, so -l -a may be written -la.
-a- Print every match in PATH, not only the first.
Variations worth knowing
The same tool, pointed at a narrower question. These four cover most of what it is reached for day to day.
echo $PATHShows the directories that are searched, in order.
type -a lsShows everything the name means: alias, builtin and file.
command -v gitThe portable form, for use in scripts.
ls -l $(which python3)Shows whether the program found is a real file or a link to another.
In cybersecurity
The shell runs the first match in PATH, whoever put it there.
A program named ls placed in a directory that comes early in PATH runs instead of the real one. which shows when a common command resolves somewhere unexpected.
With the current directory in PATH, entering a directory someone else controls can run their program in place of yours.
A script run by root or cron should call /usr/bin/tar, not tar, so it cannot be redirected by a changed PATH.