The truck crash appeared to be the latest attack in Europe using a vehicle.
Swedish broadcaster SVT said shots were fired during the attack and people in the area were reportedly seen fleeing the scene.
City authorities said they had made several spaces, including a number of school buildings, available as temporary accommodation for those who can not get home because of transport disruptions.
The Aftonbladet daily says Swedish beermaker Spendrups said its truck had been carjacked earlier Friday.
They also said early on Saturday that cordons around the crime scene in central Stockholm would remain in place until all investigative measures had been completed.
Swedish radio says a truck has crashed into an upscale department store in central Stockholm, killing at least three people.
The worst was previous year in France on the Bastille Day national holiday of July 14, in which a man rammed a truck into a crowd in the Mediterranean resort of Nice, killing 86 people. Islamic State claimed responsibility for an attack in Nice, France, last July, when a truck killed 86 people celebrating Bastille Day, and one in Berlin in December, when a truck smashed through a Christmas market, killing 12 people.
"There was a sense of panic, people standing by their loved ones, but also people running away".
"The United States and Sweden are committed partners in this fight, and we stand ready to offer any assistance to Sweden might in investigating this brutal and senseless attack".
"I went to the main street when a big truck came out of nowhere".
Photos show a beer truck sticking out of the department store.
"I heard the noise, I heard the screams, I saw the people", she told BBC News.
Police said a man, who closely resembled a grainy CCTV image they released, had been arrested and identified in Stockholm.
A police spokesperson said: "A vehicle has injured people on Drottningatan".
Swedish Prime Minister Stefan Lofven has described the crash as a terror attack.
"During a delivery to (a) restaurant, and while the driver was unloading, someone jumped into the driver's seat and drove off with it", Spendrups communications director Marten Lyth told TT Swedish news agency.
Another section of Drottninggatan was also the scene of Sweden's only other terror attack, in 2010, when a suicide bomber blew himself up, killing himself and slightly injuring several others.
In February U.S. President Donald Trump falsely suggested there had been an immigration-related security incident in Sweden, to the bafflement of Swedes.
The IS group also claimed responsibility for a truck attack that killed 86 people in Nice, France, in July during a Bastille Day festival past year and another truck attack that killed 12 people at a Christmas market in Berlin.
Police and witnesses said three persons died and many others were injured.
The auto bomb never went off and after setting fire to the Audi, he was unable to detonate the other two explosives as planned.