I'm going to steal my answer from when I answered this question on the last arduino SE attempt.
This is a bit complex. Basically, there are a number of limiting factors:
The IO lines from the microcontroller (i.e. the analog and digital pins) have both an aggregate (e.g. total) current limit, and an per-pin limit:
From the ATmega328P datasheet.
However, depending on how you define the Arduino "Pins", this is not the entire story.
The 5V pin of the arduino is not connected through the microcontroller. As such, it can source significantly more power. When you are powering your arduino from USB, the USB interface limits your total power consumption to 500 mA. This is shared with the devices on the arduino board, so the available power will be somewhat less.
When you are using an external power supply, through the barrel power connector, you are limited by the local 5V regulator, which is rated for a maximum of 1 Amp. However, this it also thermally limited, meaning that as you draw power, the regulator will heat up. When it overheats, it will shut down temporarily.
The 3.3V regulated output is able to supply 150 mA max, which is the limit of the 3.3V regulator.
- The absolute maximum for any single IO pin is 40 mA (this is the maximum. You should never actually pull a full 40 mA from a pin. Basically, it's the threshold at which Atmel can no longer guarantee the chip won't be damaged. You should always ensure you're safely below this current limit.)
- The total current from all the IO pins together is 200 mA max
- The 5V output pin is good for ~400 mA on USB, ~900 mA when using an external power adapter
- The 900 mA is for an adapter that provides ~7V. As the adapter voltage increases, the amount of heat the regulator has to deal with also increases, so the maximum current will drop as the voltage increases. This is called thermal limiting
- The 3.3V output is capable of supplying 150 mA.
- Note - Any power drawn from the 3.3V rail has to go through the 5V rail. Therefore, if you have a 100 mA device on the 3.3V output, you need to also count it against the 5V total current.
Note: This does not apply to the Arduino Due, and there are likely some differences for the Arduino Mega. It is likely generally true for any Arduino based off the ATmega328 microcontroller.