diff --git a/src/handlers/attachments.ts b/src/handlers/attachments.ts
index 3f43ecd..f3127b1 100644
--- a/src/handlers/attachments.ts
+++ b/src/handlers/attachments.ts
@@ -198,7 +198,7 @@ export async function handleGetAttachment(
     url: downloadUrl,
     fileName: attachment.fileName,
     key: attachment.key,
-    size: Number(attachment.size) || 0,
+    size: String(Number(attachment.size) || 0),
     sizeName: attachment.sizeName,
   });
 }
diff --git a/src/handlers/ciphers.ts b/src/handlers/ciphers.ts
index dd4b8b9..98f4947 100644
--- a/src/handlers/ciphers.ts
+++ b/src/handlers/ciphers.ts
@@ -11,7 +11,8 @@ export function formatAttachments(attachments: Attachment[]): any[] | null {
   return attachments.map(a => ({
     id: a.id,
     fileName: a.fileName,
-    size: Number(a.size) || 0,  // Android expects Int, not String
+    // Bitwarden clients decode attachment size as string in cipher payloads.
+    size: String(Number(a.size) || 0),
     sizeName: a.sizeName,
     key: a.key,
     url: `/api/ciphers/${a.cipherId}/attachment/${a.id}`,  // Android requires non-null url!