Police said the attacker detonated the explosives shortly after 10:33 pm (2133 GMT) at Manchester Arena, which has the capacity to hold 21,000 people. Children were among the dead, police said.
"We believe, at this stage, the attack last night was conducted by one man," Manchester Chief Constable Ian Hopkins told reporters. "The priority is to establish whether he was acting alone or as part of a network.
"We believe the attacker was carrying an improvised explosive device which he detonated causing this atrocity," said Hopkins, who declined to answer questions about whether the attacker was British.
A witness who attended the concert said she felt a huge blast as she was leaving the arena, followed by screaming and a rush by thousands of people trying to escape the building.
A video posted on Twitter showed fans, many of them young, screaming and running from the venue. Dozens of parents frantically searched for their children, posting photos and pleading for information on social media.