President Obama vowed that those responsible will "feel the full weight of justice."
A senior U.S. intelligence official said two other bombs were found near the end of the 26.2-mile course and were dismantled.
Authorities shed no light on a motive or who may have carried out the bombings, and police said they had no suspects in custody. Authorities in Washington said there was no immediate claim of responsibility.
"They just started bringing people in with no limbs," said runner Tim Davey of Richmond, Va. He said he and his wife, Lisa, tried to keep their children's eyes shielded from the gruesome scene inside a medical tent that had been set up to care for fatigued runners, but "they saw a lot."
The fiery twin blasts took place almost simultaneously and about 100 yards apart, knocking spectators and at least one runner off their feet, shattering windows, and sending dense plumes of smoke rising over the street and through the fluttering national flags lining the course.
When the second bomb went off, cheers turned to screams. As sirens blared, emergency workers and National Guardsmen who had been assigned to the race for crowd control began climbing over and tearing down temporary fences to get to the blast site.
Blood stained the pavement, and huge shards were missing from window panes.
In addition to the three people killed - one an 8-year-old boy - hospitals reported at least 134 injured, at least 15 critically.
Some 23,000 runners took part in the race, one of the world's oldest and most prestigious marathons. One of Boston's biggest annual events, the race winds up near Copley Square, not far from the landmark Prudential Center and the Boston Public Library. It is held on Patriots' Day, which commemorates the first battles of the American Revolution, at Concord and Lexington in 1775.
As bomb squads checked parcels and bags left along the race route, Boston Police Commissioner Edward Davis asked people to stay indoors or to go back to their hotel rooms and avoid crowds. He said investigators did not know precisely where the bombs had been planted or whether they had been hidden in mailboxes or trash cans.
He said authorities had received "no specific intelligence that anything was going to happen" at the race.
The FBI set up a phone line for the public to call with information about the explosions. The call-in number is 1-800-CALL-FBI (1-800-225-5324), prompt #3.
"No piece of information or detail is too small," the FBI said.
Earlier Monday, the Federal Aviation Administration had barred low-flying aircraft from within 3.5 miles of the blast site.
Obama was briefed on the explosions by Homeland Security adviser Lisa Monaco. Obama also told Mayor Tom Menino and Gov. Deval Patrick that his administration would provide whatever support was needed, the White House said.
"We still don't know who did this or why," Obama said, adding, "Make no mistake: We will get to the bottom of this."
With scant official information to guide them, members of Congress said there was little or no doubt it was an act of terrorism.
"We just don't know whether it's foreign or domestic," said Rep. Michael McCaul (R., Texas), chairman of the House Committee on Homeland Security.
A few miles away from the finish line and around the same time, a fire broke out at the John F. Kennedy Library. The police commissioner said it may have been caused by an incendiary device but did not appear to be related to the bombings.
The first loud explosion occurred on the north side of Boylston Street, just before the photo bridge that marks the finish line. The second explosion could be heard a few seconds later.
The explosions occurred about four hours into the race and two hours after the top finishers crossed the line. By that point, more than 17,000 of the runners had finished the race, but thousands of others were farther back.
The attack may have been timed for maximum carnage: The four-hour mark is typically a crowded moment near the finish line because of the slow-but-steady recreational runners completing the race and because of all the relatives and friends clustered around to cheer them on.
A 78-year-old Washington state man running his third Boston Marathon was near the finish line when he was knocked down by a blast and caught in a news photo that quickly went viral.
Bill Iffrig, of Lake Stevens, told the Herald of Everett that he heard a noise and found himself on the ground. "It was only five feet away from me," he said. "It was really loud." He said that he ended up with a scrape on his knee and that a race official helped him to his feet.
Jay Hartford, 46, a nurse at Boston Children's Hospital, was about 800 yards from the finish when he heard the explosions. He thought they were electrical and kept running. Then he saw smoke billowing. Runners started to panic, he said.
"Some people hit the ground, in shock," he said. "A woman runner was on her knees screaming" in fear, not injury.
Police along the route started pushing barriers across Boylston, to keep runners from approaching the finish line, he said.
"Stop! Turn back!" the police shouted to oncoming runners, Hartford said.
Pam Ledtke, 51, of Indianapolis, was about 75 yards from the finish line when the explosions went off. At first, she said, "everyone just stopped and hunched down. They didn't know what to do. . . . It took a minute or two to think: 'Did something technical go off?' Then the smell."
Bruce Mendelsohn, 44, who works for an engineering leadership program at MIT, was at the marathon as a spectator.
"People were on the ground lying down. Some people were walking wounded," he said. "It was like a scene from Tel Aviv or Baghdad or Pakistan."
The explosions occurred as the marathon was honoring another tragedy - the victims of the Newtown, Conn., shooting - with a special mile marker.
Boston Athletic Association president Joanne Flaminio had earlier said there was "special significance" to the fact that the race was 26.2 miles long and 26 people died at Sandy Hook Elementary School.
This article contains information from the Washington Post.