Intelligence agency chief Anders Thornberg said the man “has appeared in our intelligence gathering in the past”, but had no previous links to extremism.
Police also said they had found a suspect device in the cab of the truck.
“A technical examination is ongoing, we can't go into what it is right now … whether it's a bomb or a flammable device,” police chief Dan Eliasson told reporters.
“There is nothing to indicate that we've got the wrong man. On the contrary, the suspicions have strengthened,” Eliasson added.
A stolen beer truck barreled into shoppers on the bustling Drottninggatan pedestrian street on Friday afternoon, smashing into the facade of the Åhléns department store, above ground from Stockholm's central subway station.
Fifteen people were injured, 10 of whom remained in hospital on Saturday including a child, health authorities said.
Previous attacks using vehicles have occurred in London, Berlin and the southern French city of Nice, all of them claimed by the Islamic State (IS) group.
There has been no immediate claim of responsibility for the Stockholm attack, the third terror attack in Europe in two weeks, coming on the heels of assaults in London and Saint Petersburg.
Officials have identified one of the Stockholm victims and informed the family. One Romanian woman was among the injured, Romania's foreign ministry said.
Flags flew at half-mast across Stockholm as the city slowly returned to normal on Saturday — apart from a heavy police presence, a rare scene in this normally tranquil country.
'More of us than them'
Residents tried to come to terms with the violence that had struck a city that prides itself on its openness and tolerance.
“Just sad I think, sad and mad. Really angry with the people who did this,” 51-year-old resident Torvald told AFP.
“Unfortunately you get almost used to these situations,” said Michael, another local. “It's like in July 2016 (the Nice attack). I was very shocked and now, well, now again. Another attack.”
Prime Minister Stefan Löfven, who has beefed up border controls, announced that Sweden would hold a minute's silence on Monday in memory of the victims.
Throughout Saturday, crowds milled behind the security barrier erected around the scene of the attack, many placing flowers by the fence.
A police car parked nearby was covered in flowers, as Swedes broadly praised the emergency crews' quick response to the attack.
Photo: Markus Schreiber/AP
King Carl XVI Gustaf, who returned to Stockholm on Saturday after cutting short a visit to Brazil, gave an address to the nation outside the palace.
“The consideration people are showing each other shows the strength of our society,” he said.
“There are so many of us who want to help, many more than those who want to hurt us.”
A peaceful demonstration was planned for Sunday in central Stockholm, near the scene of the attack.
Attack 'was expected'
The suspect was detained on Friday evening in Märsta, a town north of Stockholm. According to several media outlets, he is an Isis supporter.
“His Facebook page shows sympathies to IS,” the head of the Centre for Asymmetric Threat Studies at the Swedish National Defence College, Magnus Ranstorp, told AFP.
If the suspect is confirmed as the perpetrator, that would bring to three the number of attacks in less than four months by an assailant believed to have links to Uzbekistan.
Pierre Svensson, who said he employed the suspect through a contractor for several weeks on an asbestos removal project in Stockholm late last year, described him as a reserved person.
“He was a little reserved, he didn't stick out. He did his job. You can't say he was very sociable, we just told him what to do and he did it. He didn't speak much Swedish,” he told AFP.
Intelligence agency Säpo said meanwhile it was hunting for “possible accomplices or networks that may have been involved in the attack”.
Ranstorp said an attack on Stockholm was just a matter of time.
“It was pretty expected, the police and intelligence agency have practised for this several times the past year,” he said.
“We just didn't know when it was going to happen.”
Friday's attack was the second terror attack in Stockholm.
In December 2010, a suicide bomber blew himself up, just off the Drottninggatan street, lightly injuring several passersby.