The Christchurch mosque attacks were live-streamed on the internet by a man posting online under the name Brenton Tarrant. He said he was Australian.
Distressing footage shows him firing indiscriminately at men, women and children at close range inside the Al Noor mosque.
The individual previously posted a rambling and expletive-filled document, espousing violent right-wing ideology.
A day later, the main suspect, Brenton Harrison Tarrant, 28, appeared in court in Christchurch, charged with murder.
Prime Minister Jacinda Ardern said the suspect had "travelled around the world with sporadic periods of time spent in New Zealand" and that he was currently living in Dunedin, south of Christchurch.
"I would not describe him as a long-term resident," she said
"The offender was in possession of a gun licence. I'm advised that this was acquired in November of 2017," Ms Ardern said.
She said New Zealand intelligence services had been stepping up investigations into far-right extremists, but added: "The individual charged with murder had not come to the attention of the intelligence community nor the police for extremism."
Tarrant appeared in court in Christchurch in a white prison uniform. He was remanded in custody with no bail application.
Attack streamed live
The man in the footage equipped himself with what appears to be a head-mounted camera to live-stream the attack in central Christchurch.
The streams were broadcast online, including briefly on Facebook, showing the violence in graphic detail.
A song which played in the suspect's car is known as a marching anthem for Serbian nationalist paramilitary units known as Chetniks during the 1992-95 Bosnian war.
It praises Bosnian Serb leader Radovan Karadzic, who was convicted of genocide and war crimes.
The names of men convicted of killing Muslims and migrants are written on the suspect's weaponry.
One item had the words "For Rotherham" written on it, a reference to a child abuse scandal in the UK, while other wording referenced historical battles between European countries and the Ottoman Empire.
Australian media reported that Brenton Tarrant was originally from Grafton, a town 600km (370 miles) north of Sydney, and had previously worked at a fitness facility.
"He never showed any extremist views or any crazy behaviour," his former boss, Tracey Gray, told Seven News.
The 16,500-word document he posted is entitled The Great Replacement - a phrase that originated in France and has become a rallying cry for European anti-immigration extremists.
In it, the man says he began planning an attack after visiting Europe in 2017 and being angered by events there.
Specifically, he references a lorry attack carried out by an Islamic State sympathiser in Sweden, France's decision to elect the moderate Emmanuel Macron as president, and ethnic diversity in France.
Despite insisting that he is not motivated by fame, he acknowledges that he intends to survive the attack, and hopes it will spread fear.
He chose the Al Noor mosque as his target three months ago, the document says.
The central tenet of the conspiracy is that "European peoples" are dying out and being "replaced" by immigrants with a different, inferior and dangerous culture, says the BBC's Dominic Casciani.
This is basically a code for hatred or fear of Muslims - part of the theory is that states and corporations are encouraging "white genocide" by pushing up immigration rates to keep global capitalism going, says our correspondent.
What about the others in custody?
Prime Minister Ardern said none of those in custody had been on active security watch lists in New Zealand or Australia.
"I have asked our agencies this morning to work swiftly on assessing whether there was any activity on social media or otherwise, that should have triggered a response," the prime minister said.