Is it really free?
Yes, KeePass is really free, and more than that: it is open-source (OSI certified). You can have a look at its full source and for example check if the encryption algorithms are implemented correctly.

Perhaps you wonder why I decided to make it open-source. The answer is relatively simple: in my opinion all software that has something to do with security should be open-source. Here's a quote of Bruce Schneier that sums it up pretty good:

As a cryptography and computer security expert, I have never understood the current fuss about the open source software movement. In the cryptography world, we consider open source necessary for good security; we have for decades. Public security is always more secure than proprietary security. It's true for cryptographic algorithms, security protocols, and security source code. For us, open source isn't just a business model; it's smart engineering practice.
Bruce Schneier, Crypto-Gram 1999/09/15

- KeePass supports the Advanced Encryption Standard (AES, Rijndael) and the Twofish algorithms to encrypt its password databases.
- Both of these ciphers are regarded as very secure by the cryptography community. Banks are using these algorithms for example, too.
- Even if you would use all computers in the world to attack one database, decrypting it would take longer than the age of the universe.
- Even quantum computers won't help that much. The algorithms are symmetric so its complexity would be reduced a bit, anyway, the sun will go nova before you have decrypted the database.
- The complete database is encrypted, not only the password fields. So your usernames, notes, etc. are protected, too.
SHA-256 is used as password hash. SHA-256 is a 256-bit cryptographically secure one-way hash function. Your master password is hashed using this algorithm and its output is used as key for the encryption algorithms.
- In contrast to many other hashing algorithms, no attacks are known yet against SHA-256.
- In-Memory Passwords Protection: Your passwords are encrypted while KeePass is running, so even if Windows caches the - KeePass process to disk, this wouldn't reveal your passwords anyway.
- Security-Enhanced Password Edit Controls: KeePass is the first password manager that features security-enhanced password edit controls. None of the available password edit control spies work against these controls. The passwords entered in those controls aren't even visible in the process memory of KeePass.

Size (RAR): 2 Mb
2% recovery record