The rampage at the Olympia shopping mall also injured 16 others. This attack makes it the third on civilians in Europe in the last eight days.
“Bloodbath in Munich,” was the headline on the best-selling Bild newspaper as shockwaves reverberated across the continent.
The killing sent the southern city into lockdown as elite police launched a massive operation to track down what had initially been thought to be up to three assailants.
Chancellor Angela Merkel will convene her security council on Saturday to address the shooting, which came just days after an axe rampage on a train in the same German state of Bavaria and just over a week after a truck attack in the French Riviera city of Nice that killed 84 people.
Police chief Hubertus Andrae told a press conference, “The perpetrator was an 18-year-old German-Iranian from Munich,” adding that he had no criminal record.
“The motive or explanation for this crime is completely unclear,” he said.
A police spokesman had said earlier that terrorism was suspected, without revealing any immediate indications of an Islamist link.
Armed with a handgun, the attacker opened fire at a McDonald’s restaurant and continued along the street before entering the mall.
A video posted on social media appeared to show a man in black walking away from a McDonald’s while firing repeatedly on people as they fled screaming.
One of the survivors recounting the horror of the attack, said, “We entered McDonald’s to eat... then there was panic, and people ran out.”
Another video appeared to show the gunman on a car park roof exchanging a tirade of insults with a man on a nearby balcony.
“I’m German, I was born here,” the assailant replies after the man fired off a volley of swear words, including an offensive term for foreigners.
Police initially believed there could be up to three assailants.
But Andrae later said two others had “absolutely nothing to do” with the attack -- and that they were simply fleeing the scene.
The Munich main train station, metro and bus transport was suspended while residents were ordered to stay inside, leaving the streets largely deserted.
“We are determined to do everything we can so that terror and inhuman violence stand no chance in Germany,” Merkel’s chief of staff Peter Altmaier said.
German President Joachim Gauck said he was horrified by the “murderous attack”, while US President Barack Obama voiced staunch support for Washington’s close ally.
The attack comes days after a 17-year-old asylum seeker went on a rampage with an axe and a knife on a train on Monday near Wuerzburg, also in Bavaria, injuring five people.
The train attack triggered calls by some politicians to impose an upper limit on the number of refugees coming into Germany, which accepted a record 1.1 million migrants and refugees last year, many through Bavaria.
The Munich mall is near the stadium for the 1972 Olympics and the athletes’ village which was the site of the hostage-taking of Israeli athletes by the Palestinian Black September group that ended in a massacre.
Europe has been on high alert for terrorism in the wake of a string of attacks in neighbouring France and Belgium claimed by the Islamic State.
The mall shooting occurred just eight days after 31-year-old Mohamed Lahouaiej Bouhlel used a truck to mow down 84 people, including children, after a Bastille Day fireworks display in Nice, the third major attack on French soil in the past 18 months.
In March, IS claimed suicide bombings at Brussels airport and a city metro station that left 32 people dead.
In May, a mentally unstable 27-year-old man carried out a knife attack on a regional train in Bavaria, killing one person and injuring three others.
Terror ploughs into France once again; 10 kids among 84 killed
7th terror attack in 18 months: Timeline of horror in France
'Terrorism is also a social activity'
'We will always fight this battle with our hands tied'
Why cities like Paris and Mumbai are victims of terror