The al-Shabab armed group, an al-Qaeda affiliate, said it carried out the attack in the Kenyan capital in response to US President Donald Trump's decision to recognise Jerusalem as the capital of Israel. Two people accused of facilitating the attack have been arrested.
Kenya's Red Cross said 50 people remained missing, raising the likelihood of a sharp rise in the death toll.
Of the victims, 16 were Kenyan, one was British, one was American and three were of African descent but their nationalities were not yet identified, police said.
Uhuru Kenyatta, the president of Kenya, announced the end of the 20-hour siege at the DusitD2 hotel complex that echoed a 2013 assault that killed 67 people at the Westgate mall in the same district.
"The security operation at Dusit complex is over and all the terrorists have been eliminated," Kenyatta said in a televised address on Wednesday.
Authorities sent special forces into the hotel to flush out the gunmen. The president said more than 700 civilians were rescued from the complex.
It was a tormented night for families of those trapped as they waited outside the hotel with sporadic gunfire ringing out, and the rescue of dozens of people at about 3:30am (00:30GMT).
Mourning relatives and friends gathered at a nearby mortuary on Wednesday. Families who went to the Chiromo morgue were told they could not view bodies until a forensic investigation had been performed, provoking grief and anger.
"My sister is not in any of the hospitals and the last time we spoke, she was a bit calm. But suddenly she started crying and shouting and I could hear gunshots and her phone remained on but she wasn't speaking," said a woman who gave her name as Njoki.
"We have no doubt her body is here," she said, weeping.
CCTV footage broadcast on local media showed four black-clad, heavily armed men entering the complex.
According to Kenya's police chief Joseph Boinnet, the coordinated assault began at 3pm local time (12:00 GMT) on Tuesday with an explosion that targeted three vehicles outside a bank, and a suicide bombing in the hotel lobby that severely wounded a number of guests.
Hiram Macharia, a marketing executive at LG Electronics, said security officers rescued him and some colleagues from their office two hours after the attack began. But one colleague did not survive.
"One of our colleagues went to the top of the building and his body was found there," he said.
A police source told AFP news agency two attackers were shot dead on Wednesday morning after a prolonged attack.
"The two have red bandanas tied around their forehead and bullets strapped around their chest with several magazines each," the senior police officer said. "Each had an AK-47 which has been secured."
The attack at DusitD2 was the first in Nairobi since the Westgate mall attack in 2013.
On April 2, 2015, another al-Shabab attack had killed 148 people at the university in Garissa in eastern Kenya.
The Westgate attack resulted in many upscale establishments and shopping centres in the capital - including the Dusit - putting up security barriers to check cars and pedestrians.
Like the attack at the Westgate mall, this one appeared aimed at wealthy Kenyans and foreigners.
It came a day after a magistrate ruled three men must stand trial in connection with the Westgate mall attack. ALJAZEERA