Swedish police said no-one had been arrested in connection with the attack. They showed a picture of a man wearing a grey hoodie and said they were looking for him. They did not rule out the possibility that other attackers were involved.
There was no immediate claim of responsibility.
"I turned around and saw a big truck coming toward me. It swerved from side to side. It didn't look out of control, it was trying to hit people," Glen Foran, an Australian tourist in his 40s, told Reuters.
"It hit people, it was terrible. It hit a pram with a kid in it, demolished it," he said.
"It took a long time for police to get here. I suppose from their view it was quick, but it felt like forever."
Part of central Stockholm was cordoned off and the area was evacuated, including the main train station. All subway traffic was halted on police orders. Government offices were closed.
"Sweden has been attacked. Everything points to the fact that this is a terrorist attack," Prime Minister Stefan Lofven told reporters during a visit in western Sweden. He was immediately returning to the capital.
Many police and emergency services personnel were at the scene, said a Reuters witness who saw policemen put what appeared to be two bodies in body bags. Bloody tyre tracks on Drottninggatan (Queen Street) showed where the beer truck had passed.
The truck had been stolen while making a delivery to a tapas bar further up Drottninggatan, Spendrups Brewery spokesman Marten Lyth said. A masked person jumped into the cab, started the truck and drove away.
"We were standing by the traffic lights at Drottninggatan and then we heard some screaming and saw a truck coming," a witness who declined to be named told Reuters.
"Then it drove into a pillar at Ahlens City (department store) where the hood started burning. When it stopped we saw a man lying under the tyre. It was terrible to see," said the man, who saw the incident from his car.
Police confirmed three deaths and eight people injured, including the truck driver, who had tried to stop the hijack.
Several attacks in which trucks or cars have driven into crowds have taken place in Europe in the past year. Al Qaeda in 2010 urged its followers to use trucks as a weapon.
In London on March 22, a man in a car plowed into pedestrians on Westminster Bridge, killing four, and then stabbed a policeman to death before being shot by police.
Islamic State claimed responsibility for an attack in Nice, France, last July, when a truck killed 86 people celebrating Bastille Day, and one in Berlin in December, when a truck smashed through a Christmas market, killing 12 people.
Police confirmed three deaths and eight people injured.
"Our thoughts are going out to those that were affected, and to their families," Sweden's King Carl Gustaf said in a statement.
Stockholmers opened up their homes and offered lifts to people who were unable to get home or needed a place to stay.
The attack was the latest to hit the Nordic region after the 2015 shootings in Copenhagen, Denmark, that killed three people and the 2011 bombing and shooting by far right extremist Anders Behring Breivik that killed 77 people in Norway.
Sweden has not been hit by a large-scale attack, although in December 2010, a man blew himself up only a few hundred yards from the site of the latest incident in a failed suicide attack.
Swedish authorities raised the national security threat level to four on a scale of five in October 2010 but lowered the level to three, indicating a "raised threat", in March 2016.
Police in Norway's largest cities and at Oslo's airport will carry weapons until further notice following the attack. Denmark has been on high alert since the February 2015 shootings.
"An attack on any of our member states is an attack on us all," European Union chief executive Jean-Claude Juncker said in Brussels.
"One of Europe's most vibrant and colorful cities appears to have been struck by those wishing it -- and our very way of life -- harm.
Neutral Sweden has not fought a war in more than 200 years, but its military has taken part in U.N peacekeeping missions in a number of conflict zones in recent years, including Iraq, Mali and Afghanistan.
The Sapo security police said in its annual report it was impossible to say how big a risk there was that Sweden would be targeted like other European cities, but that, if so "it is most likely that it would be undertaken by a lone attacker".