Using 32 hexadecimal digits vs ASCII equivalent 16-character password Assume I'm using a cryptographic algorithm to pseudo-randomly generate a string that is specified to be 16 characters long.  The string will be used as a passphrase when encrypting a file.

So, for instance the string is:

Z±¨Û‹'bó£´µ¼


The hexadecimal equivalent of that string is:

0x5AB1A81CDB8B279D62F3A3B405B51DBC


Is either variant "stronger", cryptographically speaking?  In other words, if I use the string as the passphase, or if I convert the hexadecimal numbers into a string and use that as the passphrase, is either one better?
They are both equal.

Passphrase security is based on the amount of entropy that the passphrase contains. In your case, both of your pieces of data are only different in the encoding. The actual entropy that they contain is the same.

You are generating a secret that is (assuming that the random source is really random) 16 bytes long. So it has 128 bits of entropy.

I should note that this answer assumes "cryptographically speaking". However, encoding your passphrase in UTF-8 or ASCII may (in practice) screw up your data. The other answers do a good job at explaining why.

Update: fgrieu correctly notes that this answer assumes that all the entropy in the passphrase is actually used. An example when this is not the case is when you generate a 256 bit key, from which you derive a 128 bit key for 128-bit AES encryption. Here the entropy is reduced to 128 bits.