First let's take care of your encoding related issues:
You can't simply say one byte equals one char. You need an encoding to transform between these, where the properties depend on that encoding.
When transforming between normal text and bytes, UTF-8 is a good choice. One character will correspond to a variable amount of bytes that way. You'd use this to turn a password into bytes.
xkcd would result in 4 bytes, but non ASCII characters, such as
ü will result in more than one byte per char.
When turning arbitrary binary data into text, use an encoding specialized in that. Hex is very popular, turning each byte into two characters. Base64 which turns 6 bits into one char is a common alternative.
Now SHA-256 returns 32 bytes of binary data. If you use hex encoding on that, you get 64 chars.
AES-128 takes a 16 byte key, which corresponds to 32 characters in hex encoding.
Next we get to your key derivation issues:
The problem with passwords is, that they tend to be weak, compared to random keys. So you need to send them through a key-derivation-function, that makes password guessing attacks more difficult.
SHA-256 is not a good choice for this, because it's fast. You should use a deliberately slow function, such as PBKDF-2, together with a random salt.
When using AES-128 truncate the output of it to 128 bits (or explicitly request 128 bits if your KDF supports that). Your password will be much weaker than even a 128 bit key, so there isn't much gain in using 256 bit keys.