It's a hardware token that supports a local PIN as a second factor.