I found the accepted answer above a bit unhelpful -- it basically just says: "read these two RFCs". So, on the theory that the quickest way to get the right answer to a question on the Internet is to provide a wrong one, and wait a few New York Minutes until someone corrects you, here's my attempt at a summary overview answer, based on a laughably cursory examination of the Wikipedia entry and the two RFCs.
basically your phone and the server app start by agreeing on a secret key, which they both know. that happens just once, when you set up the app on authenticator.
From there on in, the number that's generated every 30 seconds is based on SHA-1 hashing the secret key with the current time (in the form of a unix timestamp, rounded down to 30 seconds).
So, tl;dr: it's a hash of a shared secret with the current unix timestamp.
Or is it? Corrections welcomed...