Rainbow tables work by precomputing the hash values of potential passwords and storing them in a table. When an attacker obtains a hashed password, they can simply look up the hash in the table to find the corresponding plaintext password. This method is faster than brute-force attacks because the heavy computational work is done beforehand.