Uhuru Kenyatta said five of the attackers were shot dead and 11 suspects were in custody.
He added that the International Red Cross said 51 people were still missing, and said: "Kenya has stared down evil and triumphed."
However, it remained unclear after he addressed the nation on TV whether the four-day security operation at the upmarket Westgate centre was completely over, or whether any militants were still at large or hostages unaccounted for.
Later, al Shabaab used Twitter to claim seven of their militants were still armed in the mall.
"We have ashamed and defeated our attackers," Kenyatta said, adding that bodies were still trapped under rubble following the collapse of part of the building late in the operation. The president added that he could not confirm intelligence reports that a British woman and two or three Americans might be involved. Forensic scientists were involved in trying to identify the nationalities of the "terrorists", he said.
"Towards the tail end of the operation, three floors of the Westgate mall collapsed and there are several bodies trapped in the rubble including the terrorists," he added. The death toll had previously been put by officials at 62.
However, al Shabaab said its militants were still holding out with hostages.
The group said on its Twitter feed: "There are countless number of dead bodies still scattered inside the mall, and the Mujahideen are still holding their ground #Westgate.
"The hostages who were being held by the Mujahideen inside Westgate are still alive, looking quite disconcerted but, nevertheless, alive."
It posted a photograph of two of its fighters and described them as "unruffled and strolling around the mall in such sangfroid manner".
In an audio statement posted via Twitter, al spokesman Sheikh Ali Mohamud Rage called the militants' action a "deadly thrust" by "loyal soldiers seeking to rewrite history". If Kenya failed to pull troops out of Somalia and free al Shabaab prisoners it should "expect black days".
Kenyan Foreign Minister Amina Mohamed said "two or three Americans" and a UK woman were among the militants.
A British security source said it was possible Samantha Lewthwaite, the widow of Germaine Lindsay, one of the suicide bombers who killed more than 50 people on London's transport system in 2005, was involved in the siege.
When asked about reports Lewthwaite, dubbed the "white widow", was directly involved in the attack in Kenya, the source said: "It is a possibility. But nothing definitive or conclusive yet."
Lewthwaite is thought to have left Britain several years ago and is wanted in connection with an alleged plot to attack hotels and restaurants in Kenya.
However, last night al Shabaab denied that any women insurgents were involved in the siege.
Meanwhile, a four-year-old British boy survived the attack after telling an armed jihadist "you're a bad man", according to his uncle.
After apparently seeing his mother shot in the thigh, Elliott Prior is said to have confronted the gunman.
The gunman took pity on Elliott and his six-year-old sister Amelie, giving the pair a Mars bar each and allowing them and their mother to leave the chaotic shopping mall in the middle of the terror attack.