Authenticator apps typically work by generating a time-based one-time password (TOTP). When you log in to a service, you enter your password and then a code generated by the app. This code changes every 30 seconds, making it difficult for unauthorized users to gain access. Popular examples include Google Authenticator and Authy.