In a statement in Downing Street, the prime minister said it was "now beyond doubt that the people of Manchester and of this country have fallen victim to a callous terrorist attack" that targeted "defenceless young people". She said the security services believe they know the attacker's identity but are not yet able to confirm it.
Mrs May has chaired a meeting of the government's emergency Cobra committee and is expected to travel to Manchester later.
It is the worst terrorist attack in the UK since the 7 July bombings in 2005 in which 52 people were killed.
Greater Manchester Police Chief Constable Ian Hopkins said it was "the most horrific incident" the city had ever faced, and the "fast-moving investigation" was now working to establish whether the attacker "was acting alone or as part of a network".
Sixty ambulances attended the incident and those wounded are being treated at eight hospitals around the city.
Eyewitnesses described seeing metal nuts and bolts among the debris, and spoke about the fear and confusion that gripped the concertgoers.
Andy Holey, who had gone to the arena to pick up his wife and daughter, said: "An explosion went off and it threw me about 30ft from one set of doors to the other set of doors.
"When I got up I saw bodies lying on the ground. My first thought was to go into the arena to try to find my family."
Emma Johnson said she and her husband were at the arena to pick up her children, aged 15 and 17.
"We were stood at the top of the stairs and the glass exploded - it was near to where they were selling the merchandise," she told BBC Radio Manchester.
"The whole building shook. There was a blast and then a flash of fire afterwards. There were bodies everywhere."
Teenager Abigail Walker, who was at the concert, told the BBC: "I had to make sure I had my sister. I grabbed hold of her and pulled hard. Everyone was running and crying.
"We were just trying to figure where everyone was. It was absolutely terrifying."
Charlotte Campbell's daughter Olivia has been missing since the concert.
"She's only a 15-year-old girl, she's out there on her own because her friend has been found," she told the BBC.
"If anyone sees her contact me. Give her your phone and let her ring me. I just want her home."
ANALYSIS: GORDON CORERA, BBC SECURITY CORRESPONDENT
The UK threat level has been has been judged to be severe for nearly three years - which means an attack is considered highly likely. But in recent months the tempo of counter terrorist activity has been increasing with - on average - an arrest every day.
After the attack in Westminster by Khalid Masood in March, police and security officials have been warning that further attacks were almost inevitable.
But they also believed that those were more likely to be low-tech involving knives or vehicles. The fact that the Manchester attack involved explosives will worry them.
It may not have been at the level of complexity seen in Paris in 2015, when multiple attackers sent from Syria used guns and suicide belts, but it will still have required planning.
The blast happened close to the entrance to Victoria railway and tram station. The station has been closed and all trains cancelled.
Police also carried out a precautionary controlled explosion in the Cathedral Garden area of the city at about 01:32. The force later confirmed it was not a dangerous item.
SOURCE: BBC NEWS