While the UI does not allow it, it's technically possible to create empty token right now. There is no use case where this really make sense, so let's avoid some bad code to introduce a vulnerability.
This message was sent by Atlassian Jira (v9.3.0#930000-sha1:287aeb6)
If image attachments aren't displayed, see this article.