In more detail
A TOTP code is computed by HMAC-hashing a counter that is the current Unix time divided by the step length (normally 30 seconds), keyed with a secret shared once when you scan a QR code. Authenticator apps and the website each run the same calculation, so no message has to travel between them. The method is standardised in RFC 6238 and is a time-based variant of HOTP.
Why it matters
TOTP is the most common second step in Multi-factor authentication (MFA). It protects an account even when the password leaks, because an attacker also needs a code from your device. Because the codes depend on the clock, a device with the wrong time will produce codes the server rejects.
Example
With the RFC test secret 12345678901234567890, the 8-digit code at 59 seconds is 94287082, so the 6-digit code is 287082. You can reproduce it with the TOTP Generator.
Common confusion
TOTP is not the same as an SMS code. An SMS code is sent to you over the phone network, whereas a TOTP code is computed locally. Neither resists phishing the way a hardware security key does.