A physical-layer secure data encryption algorithm is proposed and demonstrated using chaotic constellation mapping associated with probabilistic shaping (PS) for orthogonal frequency division multiplexing passive optical networks (OFDM-PONs). The constellation of the encrypted data is uniformly distributed after chaotic diffusion in quadratic-amplitude modulation (QAM) mapping, to eliminate the statistical characteristics, where a key space of ~10 231 is created by a 4-dimensional hyper digital chaos. Moreover, PS is introduced to improve the OFDM signal transmission. A 9.4 Gb/s encrypted PS-16-QAM OFDM signal transmission is successfully demonstrated over 20 km standard single-mode fiber (SSMF), where the gain of receiver sensitivity is ~2 dB (bit-error rate @ 10 −3 ) using PS.