The car was detonated as police buses passed, Istanbul Governor Vasip Sahin told reporters, in the fourth major bombing in Turkey's biggest city this year.
There was no immediate claim of responsibility but Kurdish militants have staged similar attacks on the security forces before, including one last month in Istanbul.
Security concerns were already hitting tourism and investor confidence. Wars in neighboring Syria and Iraq have fostered a home-grown Islamic State network blamed for a series of suicide bombings, while militants from the largely Kurdish southeast have increasingly struck in cities further afield.
President Tayyip Erdogan vowed the NATO member's fight against terrorism would go on, describing the attack on officers whose jobs were to protect others as "unforgivable".
"We will continue our fight against these terrorists until the end, tirelessly and fearlessly," he told reporters after visiting some of the injured in a hospital near the blast site.
Sahin said the dead included seven police officers and four civilians and that the attack had targeted vehicles carrying members of a riot police unit. Three of the 36 wounded were in critical condition, he said.
The blast hit the Vezneciler district, between the headquarters of the local municipality and the campus of Istanbul University, not far from the city's historic heart. It shattered windows in shops and a mosque and scattered debris over nearby streets.
"There was a loud bang, we thought it was lightning but right at that second the windows of the shop came down. It was extremely scary," said Cevher, a shopkeeper who declined to give his surname. The blast was strong enough to topple all the goods from the shelves of his store.
The police bus that appeared to have borne the brunt of the explosion was tipped onto its roof on the side of the road. A second police bus was also damaged. The charred wreckage of several other vehicles lined the street.
Several witness reported hearing gunshots, although there was confusion as to whether attackers had opened fire or whether police officers had been trying to protect colleagues.
"We were told that it was police trying to keep people away from the blast scene," said Mustafa Celik, 51, who owns a tourism agency in a backstreet near the blast site. He likened the impact of the explosion to an earthquake.
"I felt the pressure as if the ground beneath me moved. I've never felt anything this powerful before," he told Reuters.
U.S. Ambassador John Bass condemned the "heinous" attack and said on Twitter the United States stood "shoulder to shoulder" with Turkey in the fight against terrorism.
Turkey has suffered a spate of bombings this year, including two suicide attacks in tourist areas of Istanbul blamed on Islamic State, and two car bombings in the capital, Ankara, which were claimed by a Kurdish militant group.
That has hit tourism in a nation whose Aegean and Mediterranean beaches usually lure droves of European and Russian holidaymakers. Russians stopped coming after Turkey shot down a Russian warplane over Syria last November.
The number of foreign visitors to Turkey fell by 28 percent in April, the biggest drop in 17 years.
"Business hasn't been very good anyway. We're now expecting fast check-outs and we think it will get worse," said Kerem Tataroglu, general manager of the Zurich Hotel, less than 300 meters from where Tuesday's blast happened.
While attacks by Islamic State have tended to draw more attention in the West, Turkey is equally concerned by the rise in attacks by Kurdish militants who had previously concentrated for the most part on the southeast.
The outlawed Kurdistan Workers Party (PKK), which has waged an armed insurgency against the state since 1984, claimed responsibility for a May 12 car bomb attack in Istanbul that wounded seven people. In that attack, a parked car was also blown up as a bus carrying security force personnel passed by.