The Somali militant group al Shabaab had threatened to strike the Westgate mall, popular with the city's expatriate community; but there was no immediate claim of responsibility from any group. Al Shabaab said it had no comment on the attack.
Police helicopters circled overhead as armed police shouted "get out, get out", and scores of shoppers fled the building. Smoke poured out of one entrance and witnesses said they heard grenade blasts.
Others said they saw about five armed assailants storm the Westgate shopping mall and that the incident appeared to be an attack rather than an armed robbery.
A witness to the attacks said that gunmen told Muslims to stand up and leave and that non-Muslims would be targeted.
More photos after the cut...
Elijah Kamau said that attackers with AK-47s and grenades made the statement about Muslims as they began their attack at the Westgate shopping mall in Kenya's capital around midday. Gunmen threw grenades and opened fire during the attack.
One eyewitness who identified himself as Taha said he heard the screech of brakes followed moments later by an explosion and then sustained gun fire from the ground floor.
Another survivor said he was shot by a man who looked Somali.
Some shoppers ran up stairs and escalators and hid around the mall's cinema complex. Police found another terrified group hiding in a toilet on the first floor.
At least two dozen wounded were wheeled out on stretchers and shopping trolleys. Many of the victims had multiple light wounds, apparently from flying debris. Other walked out, some with bloodied clothing wrapped around wounds.