diff --git a/index.cjs b/index.cjs
index 1994fc6..9d40b11 100644
--- a/index.cjs
+++ b/index.cjs
@@ -17,6 +17,10 @@ function decode (uri, urnScheme) {
   const options = querystring.parse(query)
 
   if (options.amount) {
+    // Number("0x10") is 16. BIP21 amounts are decimal BTC.
+    if (typeof options.amount !== 'string' || !/^(?:0|[1-9][0-9]*)(?:\.[0-9]+)?$/.test(options.amount)) {
+      throw new Error('Invalid amount')
+    }
     options.amount = Number(options.amount)
     if (!isFinite(options.amount)) throw new Error('Invalid amount')
     if (options.amount < 0) throw new Error('Invalid amount')
diff --git a/index.js b/index.js
index b5f8814..7cdb15d 100644
--- a/index.js
+++ b/index.js
@@ -16,6 +16,10 @@ export function decode (uri, urnScheme) {
   const options = querystring.parse(query)
 
   if (options.amount) {
+    // Number("0x10") is 16. BIP21 amounts are decimal BTC.
+    if (typeof options.amount !== 'string' || !/^(?:0|[1-9][0-9]*)(?:\.[0-9]+)?$/.test(options.amount)) {
+      throw new Error('Invalid amount')
+    }
     options.amount = Number(options.amount)
     if (!isFinite(options.amount)) throw new Error('Invalid amount')
     if (options.amount < 0) throw new Error('Invalid amount')
diff --git a/test/fixtures.json b/test/fixtures.json
index a7ac15a..af95787 100644
--- a/test/fixtures.json
+++ b/test/fixtures.json
@@ -141,6 +141,10 @@
     {
       "exception": "Invalid amount",
       "uri": "bitcoin:1BgGZ9tcN4rm9KBzDn7KprQz87SZ26SAMH?amount=Infinity"
+    },
+    {
+      "exception": "Invalid amount",
+      "uri": "bitcoin:1BgGZ9tcN4rm9KBzDn7KprQz87SZ26SAMH?amount=0x10"
     }
   ]
 }