The vehicle sped along the pedestrian area, mowing down people and sending others fleeing for cover.
Police are treating it as a terrorist attack.
The head of the Catalan region said two people had been arrested. Spanish media are reporting another suspect died in a shootout. El Mundo newspaper said the shootout happened in Sant Just Lesvern, on the outskirts of the city.
Police have released a photo of a man named as Driss Oubakir, who is alleged to have rented the van used to drive into pedestrians. Local media say he is in his 20s and was born in Morocco. It is unclear if he is one of those arrested.
So-called Islamic State has said it was behind the van attack in Las Ramblas, saying in a statement carried by its Amaq news agency that it was carried out by "Islamic State soldiers". The group gave no further evidence or details to back this claim.
The attack happened at the height of the season in one of Europe's top tourist destinations.
Witnesses said the van had deliberately targeted people, weaving from side to side as it drove down the boulevard. Spanish media reports said the driver of the vehicle - a white Fiat that had been rented in the city - then fled on foot.
Vehicles have been used to ram into crowds in a series of attacks across Europe since July last year.
As I was trying to walk to Las Ramblas I was stopped nearby at a police cordon in the tourist melting pot of beautiful, palm-filled Placa Reial.
From there, I could see armored vehicles lining Las Ramblas and ambulances screeching to get the past, a sense of panic in the air.
Soon, several plain-clothed officers in bullet-proof vests shouted at everyone to immediately evacuate the square.
Visibly stunned tourists were left wondering how this could happen in what many consider one of the safest places to visit in Europe. Local residents could not believe this was happening in their city too.
We ran to a nearby restaurant, extreme nervousness and anxiety on the faces of everyone there, getting updates from the TV inside and mobile phones ringing endlessly.
The owner told us the police wanted him to close his premises immediately and we had to seek shelter elsewhere. The security zone was being widened as the attacker was being hunted, he said.
What did people see?
A businessman from New Orleans, who was just arriving in a taxi in Las Ramblas, said: "I heard a crowd screaming. It sounded like they were screaming for a movie star.
"I saw the van. It had already been busted on the front. It was weaving left and right, trying to hit people as fast as possible. There were people lying on the ground."
Aamer Anwar said he was walking down Las Ramblas, which was "jam-packed" with tourists.
"All of a sudden, I just sort of heard a crashing noise and the whole street just started to run, screaming. I saw a woman right next to me screaming for her kids," he told Sky News.
"Police were very, very quickly there, police officers with guns, batons, everywhere. Then the whole street started getting pushed back. "Police officers who got there just started screaming at people to move back, move back."
Deadly vehicle attacks
Paris, 9 August 2017: A man rammed a BMW into a group of soldiers, injuring six.
London, 3 June 2017: Eight people died when three jihadists drove a van into pedestrians on London Bridge and then stabbed passers-by. A man was killed later in June in a van attack on Muslims in Finsbury Park.
London, 22 March 2017: Four people died when a car rammed into pedestrians on Westminster Bridge, and the driver then stabbed to death a policeman Stockholm, Sweden, 7 April 2017: Uzbek Rakhmat Akilov killed four people when he drove a lorry into a department store.
Berlin, Germany, 19 December 2016: Tunisian Anis Amri ploughed a truck into a Christmas market at Breitscheidplatz, killing 12 people
Nice, France, 14 July 2016: Tunisian Mohamed Lahouaiej-Bouhlel drove a truck into crowds on the Promenade des Anglais, killing 86 people on Bastille Day France, December 2014: A van was driven into a Christmas market in Nantes and a car rammed pedestrians in Dijon, leaving more than 20 wounded.