Some hid under desks as bullets shattered plate glass doors. Others jumped from windows, or ran out under fire.
"The security operation at dusit complex is over, and all the terrorists eliminated," President Uhuru Kenyatta told the nation, looking drained and grave.
"As of this moment, we can confirm that 14 innocent lives were lost through the hands of these murderous terrorists."
Kenyatta did not specify how many assailants there were, but CCTV clips showed at least five dressed in black.
One is seen waiting outside the restaurant before blowing himself up in a cloud of debris just after 3 p.m. (1200 GMT). Four others then shoot assault rifles crossing the car park.
The attack was claimed by Somali group al Shabaab, an al Qaeda affiliate fighting an insurgency to topple the weak U.N.-backed government and impose strict Islamic law.
Air strikes against the group have stepped up under U.S. President Donald Trump, but Tuesday's attack showed it retains ability to strike outside Somalia's borders.
Neighouring Kenya, a hub for expatriates, became a frequent target for al Shabaab after sending troops into Somalia to try to create a buffer zone along the long, porous border.
AMERICAN, BRITON AMONG DEAD
At least two groups of people had still been trapped inside as dawn broke, and gunfire continued to ring out. Some of those trapped inside sent out messages out begging for medical help.
Eleven Kenyans, an American and a Briton were among the casualties, morgue staff said. By Wednesday lunchtime, messages still circulated on social media asking for help finding people.
Some victims had been dining in the Secret Garden restaurant and lay slumped at tables, photos seen by Reuters showed.
The complex is home to offices of international companies including Colgate Palmolive, Reckitt Benckiser, Pernod Ricard, Dow Chemical and SAP , as well as the dusitD2 hotel, part of Thai group Dusit Thani.
Hiram Macharia, a marketing executive at LG Electronics, heard the first blast around 3 p.m.
"I grabbed a fire extinguisher and we started going downstairs. Then we saw two of the attackers firing at the elevators and we turned back. We hid under desks in our office," he told Reuters outside the hotel.
"They were firing twice at each of the elevator doors and the two staircase doors on each floor as they walked up the building. One of them fired at our office doors, entered slightly and then moved on."
Macharia hid in his office, but one colleague ran to the roof and was shot dead there, he added.
SUPPORT FOR SECURITY SERVICES
But the initial response on social media was largely supportive of security forces. They appeared to have avoided the mistakes made at the 2013 attack, when police and soldiers shot at each other then soldiers looted the mall.
"I thank ... the rescue operations commander ... n the rest of the security forces for saving the hostages," tweeted former legislator Boni Khalwale, whose daughter was saved.
Mamadou Dia was on a business trip from Paris for STP Consultants when he ended up huddled in a room with Chinese and Canadian residents of the hotel and a waiter who worked there.
He received updates on his telephone.
"They told us by text that the police knew we were in that room and that they would come, and one and a half hours later, the police came to evacuate us," he said.
As armed officers escorted them out, the attackers started shooting at them "like snipers," he said, adding that police fired back.
Families who went to Nairobi's Chiromo morgue were told they could not view bodies until a forensic investigation had been performed, provoking grief and anger.
The family of a missing 35-year-old man collapsed upon hearing a body had arrived with his identification papers.
"He is gone, he is gone," the father repeated into his phone as his mother wrapped a shawl around herself and wept.
Another family arrived, demanding to see whether their relative was there but were told only police had access.
As they argued, an elderly couple arrived in silence, bringing a freshly pressed suit to dress their dead son. (Additional reporting by Katharine Houreld, John Ndiso, Humphrey Malalo, David Lewis, Hereward Holland and George Obulutsa; Writing by Katharine Houreld; Editing by Andrew Cawthorne)