The attack had been motivated by "hate," mayor Olaf Scholz said, although he stopped short of declaring it a terrorist incident.
"It makes me especially angry that the perpetrator appears to be a person who claimed protection in Germany and then turned his hate against us," he said.
If confirmed as an Islamist attack, it would be the first in Germany since Tunisian Anis Amri drove a truck into crowds at a Berlin Christmas market on December 19, killing 12 and injuring 48.
News website Spiegel Online reported that the individual was named Ahmad A., who had arrived in Germany seeking asylum and had contact with the Islamist scene as well as a history of mental health problems and drug use.
More From This Section
The attacker had been scheduled to be deported, but the process had been held up as he lacked identity papers, Scholz said.
Police and the city-state's interior minister are expected to offer further details about the incident at a midday news conference today.
Jihadists have also carried out a string of random assaults in European countries using knives.
Like the Hamburg attacker, Amri was a failed asylum seeker who could not be deported for lack of documents.
The similarity between the two cases risks reopening barely healed wounds over Chancellor Angela Merkel's decision to allow more than million migrants into Germany since 2015, with just two months to go until legislative elections in September.
"These criminals want to poison our free society with fear, but they will not succeed," mayor Scholz said.