The 27-year-old, who had spent a stint in a psychiatric facility, had intended to target a music festival in the city of Ansbach but was turned away because he did not have a ticket.
“Unfortunately, this is a terrible new attack which will surely increase people's anxiety,” regional interior minister Joachim Herrmann said, adding that investigators “have not ruled out” he had an Islamist motive.
However, police said that the victim count could have been much higher if the young man had succeeded in his plan to enter the festival which was attended by around 2,000 people.
Herrmann said he was worried “the right to asylum would be undermined” by the events of the past week, which has seen attacks on a train and shopping mall in the southern German state.
Sunday's explosion happened just outside a bar in Ansbach city centre, not far from where more than 2,000 people had gathered for the concert, at around 10:00 pm.
Police have blocked off the area and emergency services were at the scene.
Bomb experts were also sent to determine the cause of the blast.
Ansbach deputy police chief Roman Fertinger said there were “indications” pieces of metal had been added to the explosive device.
The perpetrator was killed in the explosion, police said in a statement, and a spokeswoman said 12 people were wounded, three of them seriously.
Herrmann said the attacker, who came to Germany two years ago but had his asylum claim rejected after a year, had tried to kill himself twice in the past and had spent time in a psychiatric clinic.
Europe has been on edge for months after a string of deadly attacks claimed by the Islamic State jihadist group, including bombings in Brussels and carnage at Bastille Day celebrations in the southern French city of Nice.
In Bavaria, which has been a gateway for thousands of Syrian refugees, nine died in a shooting rampage in Munich on Friday and several people were wounded in an axe attack on a train near Würzburg.