How can I verify this claim? De-compiling?

Also it's very easy to use proper crypto in the wrong way. How can I know this is not the case here?

You make a very fair point and raise a reasonable concern. We do participate in external security audits, and will be having Cure53 do an in-depth one of 1Password for Linux. https://support.1password.com/security-assessments/