Despite similarities, it is really important to understand that passwords and cryptographic keys should not be carelessly conflated. Some important contrasts:
- Passwords are normally selected by human beings according to their whims. Cryptographic keys are meant to be randomly generated by an algorithm.
- Passwords are usually intended to be memorized by human beings. A strong cryptographic key cannot generally be memorized—they're too random and complex—and thus generally stored in a secure device. In the parlance of multi-factor authentication, passwords are "something you know" while cryptographic keys are "something you have."
- Passwords have to be text that human beings can manually input into their devices. Cryptographic keys are fundamentally binary data (despite being sometimes serialized and deserialized as text) and are generally not meant to input manually.
I say all this because your question really comes down to a lack of understanding of these differences. AES doesn't use passwords, it uses keys. AES-128 keys are fixed-length binary data; they don't really have "characters" because they're not text. As others have said, the maximum key size for AES-128 is the same as the minimum and only key size: 128 bits.
Many programs that use AES-128, however, do present a password-based user interface, and maybe you've encountered one of these. But what these programs are doing, behind the scenes, is internally transforming the user's password into a proper cryptographic key. In those programs your password can generally be any sensible length you like, but generally then the password is the weakest link—an attacker who can guess your password doesn't need to crack the AES encryption. So to achieve the full security strength of AES-128 in such a program you would need to choose an extremely strong password—something most users won't know how to do. In this case I recommend looking into Diceware and their FAQ, which has some useful advice on how complex of a password to choose.