The suspect, a Polish citizen, was shot and arrested by police after an exchange of fire and taken to a hospital, public broadcaster TVP Info reported.
Three other bodies were later found at his home in the town of Ostrowiec Świętokrzyski, about 200 kilometres north of Kraków.
They were believed to be members of his immediate family, Prime Minister Donald Tusk said, although their identities and the circumstances of their deaths had yet to be officially confirmed.
Interior Minister Marcin Kierwiński said initial findings suggested the attacker had been influenced by far-right ideology.
Investigators were examining his background and possible links to other people, but authorities had not established a motive.
Police said they began receiving reports of the shooting at about 3 p.m. The masked gunman drove onto the square and fired at passers-by from his car, sending people fleeing for cover in nearby buildings, cafes and restaurants.
A passing tram was also hit by gunfire, shattering a window in the driver's cab. No one aboard was injured, Polish state news agency PAP reported.
The suspect then fled and, after crashing into another car, got out and opened fire on police officers.
Officers returned fire, wounding and subduing him, police said.
Photo: PAP/Art Service
Authorities said there was no second attacker, correcting earlier reports suggesting another person might have been involved.
Police identified the suspect as a 24-year-old resident of the south-central Świętokrzyskie region who had a firearms licence and no known criminal record.
He was wearing military-style clothing and used a rifle believed to be an AR-15.
Police said they found numerous other firearms and ammunition in his vehicle, along with military-style equipment.
Kierwiński praised the police response, saying officers fired at the attacker three minutes after receiving the first report.
Police later said the first patrol began responding 23 seconds after the call.
About 30 police units took part in the operation, according to Polish police chief Marek Boroń.
Two police officers were among the wounded.
One suffered a gunshot wound, while the other sustained three gunshot wounds and was in "very serious condition," Kierwiński said.
Police denied reports that either officer had died.
Foreign nationals among victims
Boroń said one of the six people killed in the shooting was a British citizen and three were Polish women.
The other two victims had not yet been identified.
Five foreign nationals injured in the shooting were from Austria, Germany, Portugal, Russia and Britain, the Reuters news agency reported, citing an interior ministry spokesperson.
Police, prosecutors and officers from the Internal Security Agency (ABW) and Military Counterintelligence Service (SKW) were involved in the investigation.
Counterterrorism officers searched the suspect's home in Ostrowiec Świętokrzyski, where the three bodies were found.
Authorities said a drone had been used to inspect the property because of concerns that weapons might be inside.
Residents of the building were evacuated, according to local media.
Justice Minister Waldemar Żurek said the situation in Kraków was under control but that operations at the scene could continue through the night and into Sunday.
He asked residents and visitors to stay in their homes or hotels to avoid disrupting the work of emergency services and investigators.
Tusk, who travelled to Kraków with Kierwiński and senior police officials, urged the public to rely on information released by the authorities and not to spread unverified reports.
Nation in mourning
Kraków Mayor Łukasz Gibała declared a period of mourning in the city until November 11.
Tusk announced that Sunday and Monday would be days of national mourning, and President Karol Nawrocki signed a decree formalising the decision.
Nawrocki expressed condolences to the victims' families and said his thoughts were with those injured.
Messages of sympathy also kept pouring in from international leaders, including Ukrainian President Volodymyr Zelensky and the European Union's foreign policy chief Kaja Kallas.
'Savage and murderous attack': US ambassador
The US ambassador to Poland, Tom Rose, condemned the rampage as "a savage and murderous attack that’s shattered the peace of Poland."
"May the blessed memory of those lost today assuage the grief of those who mourn," he wrote on X.
(gs)
Source: IAR/PAP, TVP Info/TVN24, Reuters