Discussion of Passphrase Entropy and Entropy Estimation Tools

The zxcvbn tool used by Bitwarden estimates only 79 bits of entropy for your example phrase. However, every entropy estimation method that is based on the password/passphrase as a starting point (including your estimate of 170 bits and zxcvbn’s estimate of 79 bits) is inherently flawed, because it relies on assumptions about the cracking strategy — which is unknowable. For example, if I wanted to hunt for passphrases created by individuals for whom concerts were a memorable experience, I could set up a dictionary attack of the form BandName+City+RecentYear which would easily find your three “words”; I would then only need to introduce special characters and misspellings — this strategy would result in even less entropy than the 79 bits estimated by zxcvbn.

My point is that if you want to be sure that your password entropy is as high as you think it is, you need to use an entropy estimation method based on analysis of the process by which the password/passphrase was created, not an analysis of a specific exemplar. For example, a random passphrase generator based on a diceware-style word list (7776 words) will generate approximately 13 bits of entropy per word — unless you start cherry-picking passphrases and re-roll the generator if it contains words that you don’t “like”.