A White House official said it would treat the attack as an "act of terror".
It was the worst bombing on US soil since security was tightened after the attacks of September 11 2001, and President Barack Obama promised to hunt down whoever was responsible for the attack on a day when tens of thousands of spectators packed the streets to watch the world-famous race.
No one has been arrested and the White House official said it would have to be determined whether the attack came from a foreign or domestic source.
Investigators found what could be five additional, undetonated explosive devices around the Boston area, the Wall Street Journal reported, citing two unnamed people briefed on the investigation. The evidence had yet to be fully analyzed, the Journal said.
The blasts a few seconds apart knocked some runners off their feet and shattered what had been a resplendent spring day with the state of Massachusetts celebrating Patriots' Day, which commemorates the US war of independence on the third Monday in April.
April 15 is also the deadline for US taxpayers to file their annual income tax returns.
Many runners were heading for the finish when a fireball and smoke rose from behind cheering spectators and a row of flags representing the countries of participants, video from the scene showed.
The cheers turned to screams and panic.
"I saw people who looked like they had their legs blown off. There was a lot of blood over their legs. Then people were being pushed in wheelchairs," said Joe Anderson, 33, a fisherman from Pembroke, Massachusetts, who had just run the race holding a large US flag.
Many of the victims were gravely injured, Massachusetts Governor Deval Patrick said.
Some suffered shrapnel wounds and amputations and will require repeat operations in the coming days, said Peter Fagenholtz, a trauma surgeon at Massachusetts General Hospital.
Ambulances, fire trucks and dozens of police vehicles converged at the scene, and spectators could be seen crying and consoling each other.
The dead included an 8-year-old boy, the Boston Globe reported, citing two law enforcement sources briefed on the investigation.
A 2-year-old was being treated with a head injury at Boston Children's Hospital, the hospital said in a statement.
"It sounded like a sonic boom. I haven't stopped shaking yet," said Melissa Stanley, who watched her daughter cross the finish line four minutes before the explosions.
The blasts put police on alert in major cities across the United States, including in Washington, D.C. and New York City, sites of the Sept. 11 attacks.
'Powerful devices'
Boston Police Commissioner Ed Davis called them "powerful devices."
Davis told a news conference at least three people died and Massachusetts Governor Deval Patrick said more than 100 people were wounded.
FBI Boston Special Agent In Charge Richard DesLauriers declined at the same news conference to comment on media reports that police found unexploded devices.
In Washington, Obama told reporters, "Make no mistake, we will get to the bottom of this and we will find out who did this."
"Any responsible individuals, any responsible groups will feel the full weight of justice," he said.
The US Federal Bureau of Investigation took the lead on the investigation with help from several other federal, state and local law enforcement agencies.
The two explosions at 6.50pm GMT were about 50 to 100m apart as runners crossed the finish line with a timer showing four hours and nine minutes, some nine minutes faster than the average finish time, as reported by Runner's World magazine.
Spectators typically line the 42.19km race course, with the heaviest crowds near the finish line.
Mike Mitchell of Vancouver, Canada, a runner who had finished the race, said he was looking back at the finish line and saw a "massive explosion".
Smoke rose 15 metres in the air, Mitchell said. People began running and screaming after hearing the noise, Mitchell said.
"Everybody freaked out," Mitchell said.
The annual Boston Marathon, held since 1897, attracts an estimated half-million spectators and about 20 000 participants every year.
Earlier on Monday, Ethiopia's Lelisa Desisa and Kenya's Rita Jeptoo won the men's and women's events respectively, continuing African runners' dominance in the sport.
The Boston Symphony Orchestra canceled Monday night's concert and the National Hockey League's Boston Bruins canceled their home game against the Ottawa Senators. The Boston Red Sox had completed their Major League Baseball game at Fenway Park before the explosions. – Reuters