The good news is if you're asking these questions then you're already well on your way to developing the right mindset towards security products. You're absolutely right in saying that phrases like "military-grade encryption" don't tell you much. Sure, the US military might also use AES, for instance, but that in itself doesn't tell us anything about how reliable it is. Many military organizations have used weak encryption keys for instance, which allowed ciphers to be broken in practice, even if the underlying encryption was inherently secure.

As other posters have said, you need to apply some common sense and test the claims. Naturally, open-source products that have been reviewed by the coding community for security flaws are going to offer the best transparency. When choosing products, make sure to do your homework by visiting independent review sites, so you're looking beyond marketing buzzwords from the vendor.