Five others were wounded in the Halloween night attack. A man in his mid-20s was arrested shortly before 01:00 (06:00 GMT) on Sunday.
Police said an initial probe found the suspect was not affiliated with any extremist groups.
The attack took place in the historic Old Quebec neighbourhood.
Prime Minister Justin Trudeau said on Twitter: "My heart breaks for the loved ones of the two killed in last night's horrific attack in Quebec City.
"I'm also wishing a full recovery to the injured. We're keeping you in our thoughts and will be there for all of you."
He also thanked first responders for their critical work.
The identity of the suspect has not been made public.
At a news conference on Sunday, Quebec City Police Chief Robert Pigeon said it was believed that the attack was premeditated, adding that the suspect, from the Montreal suburbs, came to Quebec City with "the intention of doing the most damage possible".
"Dressed in medieval costume and armed with a Japanese sword, everything leads us to believe he chose his victims at random," Mr Pigeon added.
The suspect had spoken of conducting an attack "in a medical context" five years ago but was not known to police and did not have a criminal record, police said.
First reports of the incident near the French-speaking city's national assembly came through shortly before 22:30 local time on Saturday.
The suspect was arrested near the Espace 400e business park.
Quebec's Le Soleil newspaper reported that he was lying on the ground, barefoot and hypothermic, when he was arrested. He surrendered to police without any resistance, it said.
Following his arrest, the suspect was taken to hospital for "evaluation".
The five wounded are also being treated in hospital, with varying levels of injury, according to police.
Police have not released details of the victims' identities or ages.
Reporters at the scene have tweeted photos of a police command post outside Quebec's Parliament Building.