Greenmountain's link below (and the Wikipedia page for Rainbow Table) cover it, but you do a space-for-speed tradeoff by basically re-hashing your hash repeated

Greenmountain's link below (and the Wikipedia page for Rainbow Table) cover it, but you do a space-for-speed tradeoff by basically re-hashing your hash repeatedly, and looking up if the result is in the table, which gives you a short-list of passwords from the pre-computed domain to try. There is a diminishing-returns limit to how small your rainbow table can be before it starts getting both false positives and false negatives, and bigger password domain makes it worse, but they require less than 1 bit per covered password.