A novel physical layer data encryption scheme using two-level constellation masking in three-dimensional (3D) carrier-less amplitude and phase modulation (CAP) passive optical network (PON) is proposed in this Letter. The chaotic sequence generated by Chua’s circuit model realizes two-level encryption of displacement masking and constellation rotation for 3D constellations. We successfully conduct an experiment demonstrating 8.7 Gb/s 3D-CAP-8 data transmission over 25 km standard single-mode fiber. With two-level constellation masking, a key space size of 2.1 × 10⁸⁵ is achieved to bring about high security and good encryption performance, suggesting broad application prospects in future short-range secure communications.