The blasts threw people to the ground, killing two and injuring dozens. One of the dead was an 8-year-old boy, according to a state law enforcement source.
Hospitals reported at least 141 people are being treated, with at least 17 of them in critical condition and 25 in serious condition. At least eight of the patients are children.
At least 10 people injured had limbs amputated, according to a terrorism expert briefed on the investigation.
Terror attack disrupts Boston Marathon Watch Boston Marathon explosions Obama: We will get to the bottom of this CNN producer: Heard big boom, saw smoke
Doctors are "pulling ball bearings out of people in the emergency room," the expert said, suggesting the bombs were designed to propel shrapnel.
"Any responsible individuals, any responsible groups, will feel the full weight of justice," President Barack Obama vowed.
Boston "is a tough and resilient town," he said, adding that Americans will stand by Bostonians "every single step of the way."
'Like a huge cannon'
The terrorist attack, near the marathon's finish line, triggered widespread screaming and chaos, shattered windows and barricades and sent smoke billowing into the air at Copley Square.
The blasts were about 50 to 100 yards apart, officials said, on a stretch of the marathon course lined with spectators cheering runners through the final yards of a 26-mile, 385-yard endurance feat.
"It felt like a huge cannon," a witness told CNN about one of the blasts.
Photos from the scene showed people being carried away on stretchers. One man in a wheelchair had blood all over his face and legs.
The bombs shook buildings, sending people to seek shelter under tables, witnesses said.
Federal authorities are classifying the bombings as a terrorist attack, but it's not clear whether the origin was domestic or foreign, a federal law enforcement official with knowledge of the investigation said.
A federal law enforcement official told CNN that both bombs were small, and initial tests showed no C-4 or other high-grade explosive material, suggesting that the packages used in the attack were crude explosive devices.
Investigators warned police to be on the lookout for a "darker-skinned or black male" with a possible foreign accent in connection with the attack, according to a law enforcement advisory obtained by CNN. The man was seen with a black backpack and sweatshirt and was trying to get into a restricted area about five minutes before the first explosion, the lookout notice states.
Running list of things we know
Another explosive device found
Authorities in Boston found at least one other explosive device that they were dismantling, Boston Police Commissioner Ed Davis said.
Rep. Bill Keating of Massachusetts, meanwhile, said there were two more found.
One unexploded device was found at a hotel on Boylston Street near the bomb site and another unexploded device was found at an undisclosed location, Keating, a Democrat and member of the House Homeland Security committee, said, calling the bombing a "sophisticated, coordinated, planned attack."
Davis said a third blast at the John F. Kennedy Presidential Library was believed to be related to the marathon bombings, but police later said that incident was believed to be fire-related. The library said all staff and visitors are safe.
It was unclear who may have planted the marathon bombs. There were no credible threats before the race, a state government official said.
There is no suspect in custody, but many people are being questioned, Davis said.
In addition to scrutinizing images of surveillance cameras in the area, the FBI likely was issuing subpoenas for records from cell towers in the area to isolate and trace calls from around Copley Square at the time of the blasts, according to a federal law enforcement official who now works in the intelligence community.
The unexploded devices that were recovered could provide a treasure trove of information such as fingerprints and indications of the bomb maker's design, and from the bombs that did explode, investigators would be looking for fragments and anything indicating the "signature" of the bomb makers, the official told CNN.
As authorities searched the scene, numerous suspicious packages were found, possibly because people fled the area, leaving items behind. Investigators were checking them.
All off-duty Boston police were called in.
The Marriott hotel at Copley Place was evacuated as a precaution.
The Lenox Hotel was also evacuated as a precaution, the Boston Globe reported.
Flights banned over Boston Marathon blast site
Crowds were in the area watching the runners take part in the world's oldest annual marathon.
It was also Patriot's Day, commemorating the opening battle of the Revolutionary War.
Within seconds, the festive occasion turned into devastation.
"This is a horrific day in Boston," Massachusetts Gov. Deval Patrick said in a statement.
"My thoughts and prayers are with those who have been injured. I have been in touch with the president, Mayor (Thomas) Menino and our public safety leaders. Our focus is on making sure that the area around Copley Square is safe and secured. I am asking everyone to stay away from Copley Square and let the first responders do their jobs."
U.S. Attorney General Eric Holder spoke with FBI Director Robert Mueller and U.S. Attorney Carmen Ortiz, a Justice Department official said.
Holder has directed the full resources of the Justice Department to be deployed to ensure the matter is fully investigated, the official said.
The Federal Aviation Administration placed a flight restriction over the site of the blasts.
Other cities, including New York and Washington, tightened security as a result. Following standard protocol, the White House cleared out an area in front of the West Wing.
"If you see something, say something," Mark Boughton, mayor of Danbury, Connecticut, wrote on Twitter. "All cities will be on a heightened state of alertness per Homeland Security protocols."
Mike Baingon, who works at the Atlantic Fish Company in Boston, said an explosion took place in front of the restaurant and that he was right by the front door at the time.
The explosions occurred at about 2:45 p.m., more than two hours after the first of the race's nearly 27,000 runners had crossed the finish line, CNN Producer Matt Frucci reported.
The race was halted as was subway service into the area.
Runners east of Massachusetts Avenue were directed to Boston Common; those west of Massachusetts Avenue were directed to Kenmore Square, the state's emergency management agency said.
Troops from the Massachusetts National Guard, already at the site as part of the marathon's security and crowd-management plan, were assisting police as well.