Governor Ali Yerlikaya announced the death toll on Twitter after the explosion at about 4.20pm.
Police cordoned off an area around Istiklal, where there were dense crowds on Sunday afternoon, and helicopters flew over the city centre as sirens sounded.
"I was 50-55 metres away, suddenly there was the noise of an explosion. I saw three or four people on the ground," witness Cemal Denizci, 57, told AFP.
"People were running in panic. The noise was huge. There was black smoke," he said.
On Sunday evening, Turkish President Recep Tayyip Erdogan said that six had died in the “heinous attack”. Reports suggested 88 people were wounded.
Mr Erdogan said those responsible would be hunted down.
"Efforts to defeat Turkey and the Turkish people through terrorism will fail today just as they did yesterday and as they will fail again tomorrow," Mr Erdogan said.
"Our people can rest assured that the culprits behind the attack will be punished as they deserve."
He said initial information suggested "a woman played a part".
"A woman had been sitting on one of the benches for more than 40 minutes and then she got up," Turkish Justice Minister Bekir Bozdag told A Haber television.
"One or two minutes later, an explosion occurred.
"There are two possibilities. There's either a mechanism placed in this bag and it explodes, or someone remotely explodes [it].
"All data on this woman are currently under scrutiny."
Purported security camera footage taken moments before the explosion showed a throng of shoppers walking down the street before the blast happened.
The Turkish Red Crescent said blood for transfusion was sent to hospitals in the vicinity and there was no “urgent need” for donations.
The avenue is one of the city's busiest shopping streets and is close to tourist attractions.
Locals said shops had been closed and the area cordoned off, with police, paramedics and the fire service present.
A helicopter flew above the scene of the blast and ambulances were parked nearby.
On Sunday, the UAE strongly condemned the terrorist bombing.
In a statement, the UAE expressed its "strong condemnation of these criminal acts, and its permanent rejection of all forms of violence and in contravention of human values and principles".
The country expressed its "sincere condolences to the government and people of Turkey, and to the families of the victims of this heinous crime, wishing all of those injured a speedy recovery."
The Gulf Co-operation Council, consisting of the UAE, Saudi Arabia, Bahrain, Qatar, Kuwait and Oman, also condemned the attack.
Nayef Al Hajraf, Secretary General of the GCC, "affirmed the firm position of the GCC states against violence, terrorism and extremism, extending condolences and sympathy to the Republic of Turkey for their victims, and wishing all the injured a speedy recovery".
European Council President Charles Michel also sent "condolences" following the "horrific news" of the attack.
The US on Sunday also condemned "the act of violence that took place today in Istanbul".
"Our thoughts are with those who were injured and our deepest condolences go to those who lost loved ones," White House press secretary Karine Jean-Pierre said.
"We stand shoulder-to-shoulder with our Nato ally Turkey in countering terrorism."
French President Emmanuel Macron said in a message to Turkey: "We share your pain. We stand with you in the fight against terrorism".
Israeli President Isaac Herzog tweeted: "Shaken by news of the despicable bombing in Istanbul targeting innocent civilians.
"The whole world must stand united and firm against terror."
Ukrainian President Volodymyr Zelenskyy posted on Twitter: "The pain of the friendly Turkish people is our pain."
Turkey's media watchdog said it has placed a temporary ban on reporting on the incident, prohibiting publication of footage from the explosion or its aftermath. It imposed such restrictions after earlier terrorist attacks.
Video footage showed panicked residents fleeing after a loud sound was heard and people lying on the ground. Unconfirmed reports said children were among the victims.
The city was hit by terrorist attacks from 2015 to 2017, carried out by ISIS and Kurdish militant groups. Several took place in areas frequently visited by tourists.
The area of Sultanahmet, home to the Hagia Sophia and the Blue Mosque, was hit by an ISIS suicide bombing that killed 13 in January 2016.
Later that year, 41 people were killed after ISIS militants attacked the city's Ataturk airport.
In 2017, 39 people were killed after an ISIS gunman opened fire at Reina nightclub in the Ortakoy neighbourhood.
The perpetrator, an Uzbek, was sentenced to 1,368 years in jail for the New Year's Eve attack. It came weeks after 38 were killed in a bomb attack claimed by an offshoot of the Kurdistan Worker's Party.
Over the same period, Turkey's security forces have launched regular raids against suspected ISIS and PKK militants, arresting thousands. In December 2019, Turkish security forces detained 124 suspected ISIS members in a single night of raids.
But the country has remained vulnerable to ISIS attacks, having been used as a transit point by the militants at the height of the group's power in Iraq and Syria, before the organisation was all but destroyed by an international coalition.